https://github.com/taviso/avscript
so apparently Avast have a Javascript interpreter in its non-sandboxed, privileged main process 🙃