EJS Site Builder runs as a Node JS CLI app and is written in typescript.
Your generate scripts are loaded and run using the Node JS VM. See Node JS VM Documentation.
From the docs, please note this carefully:
The vm module is not a security mechanism. Do not use it to run untrusted code.
This should not be a surprise to you if you use NPM in your other projects. You should never blindly trust NPM modules, nor the code that you write for your generate scripts.
In your generate scripts you have access to "require", which allows you to import modules you add via npm to your project.
EJS Site Builder is around 2000 lines of typescript code.
Here are the NPM modules EJS Site Builder depends on: