SandboxJS is a JavaScript sandboxing library. Prior to 0.8.35, SandboxJS timers have an execution-quota bypass. A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog. Version 0.8.35 fixes this issue.

Affected: npm: @nyariv/sandboxjs

## Summary

Assumed repo path is `/Users/zwique/Downloads/SandboxJS-0.8.34` (no `/Users/zwique/Downloads/SandboxJS` found). A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog.

**Impact:** execution quota bypass → CPU/resource abuse

---

## Details

- **Affected project:** SandboxJS (owner: nyariv) - **Assumed checked-out version:** `SandboxJS-0.8.34` at `/Users/zwique/Downloads/SandboxJS-0.8.34`

### Vulnerable code paths

- **`/src/eval.ts`** — `sandboxFunction` binds `ticks` using `ticks || currentTicks.current`: ``` createFunction(..., ticks || currentTicks.current, { ...context, ... }) ``` Relevant lines: 44, 53, 164, 167.

- **`/src/evaluator.ts` / `/src/executor.ts`** — global ticks: ``` export const currentTicks = { current: { ticks: BigInt(0) } as Ticks }; ``` and ``` _execNoneRecurse(...) { currentTicks.current = ticks; ... } ``` Relevant lines: ~1700, 1712.

- **`sandboxedSetTimeout`** compiles string handlers at execution time, not at scheduling time, which lets `currentTicks.current` be the wrong sandbox's ticks when com…