github analyzed 2c1d78e

ekingunoncu/izan.io

Turn Any Browser Action & Data Extraction into an AI Tool in 60 Seconds

Drift inferred · capture-to-capture

HIGH 2026-06-14 code analysis flagged dynamic code execution ×2 in ekingunoncu/izan.io

capabilities0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsgithub-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2c1d78e · analyzer v17 · 1d ago

dynamic code executionnew Function()ekingunoncu-izan.io-2c1d78e/apps/zihin.io/.next/static/chunks/webpack.js:181/******/ return this || new Function('return this')();
dynamic code executionnew Function()ekingunoncu-izan.io-2c1d78e/packages/extension/src/sandbox.ts:151const fn = new Function('return (' + normalized + ')')()

code evidencevv0.1.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs ekingunoncu-izan.io-2c1d78e/apps/web/scripts/generate-seo.ts :8 import fs from "node:fs";
fs ekingunoncu-izan.io-2c1d78e/apps/zihin.io/scripts/generate-seo.ts :6 import fs from "node:fs";
fs ekingunoncu-izan.io-2c1d78e/packages/extension/vite.config.ts :3 import { copyFileSync, mkdirSync, existsSync } from 'node:fs'

net ekingunoncu-izan.io-2c1d78e/apps/web/app/components/GitHubStarButton.tsx :28 const res = await fetch(GITHUB_STARS_PROXY, { cache: "no-store" });
net ekingunoncu-izan.io-2c1d78e/apps/zihin.io/.next/static/chunks/webpack.js :1347 /******/ return fetch(__webpack_require__.p + __webpack_require__.hmrF()).then((response) => {
net ekingunoncu-izan.io-2c1d78e/apps/zihin.io/vite.config.ts :5 import type { IncomingMessage, ServerResponse } from "node:http";
net ekingunoncu-izan.io-2c1d78e/packages/extension/scripts/reload-server.mjs :1 import { createServer } from 'node:http'
net ekingunoncu-izan.io-2c1d78e/packages/extension/scripts/vite-plugin-extension-reload.ts :16 await fetch(`${RELOAD_SERVER_URL}/trigger`, { method: 'POST' })
net ekingunoncu-izan.io-2c1d78e/packages/extension/src/dynamic-server.ts :267 url: z.string().describe('Full URL to fetch (e.g. "https://example.com")'),
net ekingunoncu-izan.io-2c1d78e/packages/extension/src/sidepanel/App.tsx :60 try { const r = await fetch(`${GITHUB_RAW}/tools/index.json`); return r.ok ? r.json() : [] } catch { return [] }
net ekingunoncu-izan.io-2c1d78e/packages/extension/src/sidepanel/code-editor.tsx :47 * await browser.evaluate('fetch("/api/data").then(r => r.json())')

secrets ekingunoncu-izan.io-2c1d78e/apps/zihin.io/.next/server/server-reference-manifest.js :1 self.__RSC_SERVER_MANIFEST="{\n \"node\": {},\n \"edge\": {},\n \"encryptionKey\": \"process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY\"\n}"
secrets ekingunoncu-izan.io-2c1d78e/apps/zihin.io/vite.config.ts :33 client_secret: process.env.CLIENT_SECRET_GITHUB,