First, let's get this out of the way: You MUST TRUST THE SOURCE OF THAT CODE. You're asking how to run arbitrary code from a string in your environment. If that code is malicious, bad things can happen. So you must trust the source of the code (e.g., whoever gave it to you).
Assuming you trust whomever you're getting the code from:
Given the const in your const es6code, you're running this code in an "ES6" (which is to say, ES2015+) environment. So...
const f = new Function(es6code + "; return square;")();
// Note ----------------------^^^^^^^^^^^^^^^^^^^^^ ^^
// And --------------------------------------------/
then
console.log(f(5)); // 25
If you need to transpile it first, use the Node API for Babel to transform the code first:
var code = require("babel-core").transform(es6code, options);
...and then do #1 on the result.
constin yourconst es6code, you're running this code in an "ES6" (which is to say, ES2015+) environment. So...const f = eval(es6code)and thenf(5)as necessary -- IF you trust the source of the code and are happy to run that code in your environment.evalfunction?es6code; I've posted an answer that is.