The deferred classic script searches that embedded data without a fetch, external dependency, or numerical backend; a local file opening therefore does not depend on module or fetch permissions.
Static analysis of a PDF email attachment using pdfid and pdf-parser to identify JavaScript, inspect OpenAction entries, and ...