Agreed. Even eslint security would flag stuff like this.