In _onPostMessage function on line ~120 JSON.parse(e.data) is run, but does not check if e.data is a string.