serialize-javascript 7.1.2 - embedding alone triggers execution
(payload has not run yet)