browser
Warn
Audited by Socket on Mar 6, 2026
1 alert found:
AnomalyAnomalyscripts/eval.cjs
LOWAnomalyLOW
scripts/eval.cjs
This script is a legitimate-sounding developer utility that intentionally sends and executes arbitrary JavaScript in a browser page via the Chrome DevTools Protocol. It contains no direct obfuscation, hardcoded secrets, or built-in exfiltration behavior. However, because it evaluates untrusted input in a browser page context, it poses a significant danger if used with untrusted expressions or in automated environments where input can be controlled by an attacker. Use only with trusted inputs and ensure the DevTools endpoint is not exposed to untrusted networks/processes.
Confidence: 90%Severity: 60%
Audit Metadata