github analyzed bad1b2c

gnh1201/welsonjs

WelsonJS - Build a Windows app on the Windows built-in JavaScript engine

Drift inferred · capture-to-capture

HIGH 2026-06-14 code analysis flagged hidden prompt content, dynamic code execution ×8 in gnh1201/welsonjs

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit bad1b2c · analyzer v18 · 8h ago

⚠ hidden: readme: hidden-unicodegnh1201-welsonjs-bad1b2c/README.md:163* :eyes: [Hacker News](https://news.ycombinator.com/item?id=41316782&utm_source=welsonjs), [Node Weekly (#‹U+200B›582 - June 17, 2025)](https://nodeweekly.com/issues/582?utm_source=welsonjs), [WebTool

dynamic code executioneval()gnh1201-welsonjs-bad1b2c/app.js:351return eval(require._load(FN));
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/app/assets/js/json2.js:515j = eval("(" + text + ")");
dynamic code executionnew Function()gnh1201-welsonjs-bad1b2c/app/assets/js/linq-4.0.2.wsh.js:55f = new Function(args, "return " + expression);
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/app/assets/js/peg-0.10.0.js:143case "parser": return eval(ast.code);
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/lib/autoit.js:46eval("this._interface." + functionName + "(\"" + args.map(addslashes).join("\", \"") + "\")");
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/lib/file.js:99eval(readFile(path));
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/lib/jsunit.js:1022testObj = eval(source);
dynamic code executioneval()gnh1201-welsonjs-bad1b2c/mcploader.js:103return String(eval(script));
credential in logscredential in loggnh1201-welsonjs-bad1b2c/lib/anthropic.js:18console.log("Anthropic (Claude) API KEY:", apikey);
credential in logscredential in loggnh1201-welsonjs-bad1b2c/lib/chatgpt.js:18console.log("OpenAI (ChatGPT) API KEY:", apikey);
credential in logscredential in loggnh1201-welsonjs-bad1b2c/lib/grok.js:18console.log("Grok (x.ai) API KEY:", apikey);
credential in logscredential in loggnh1201-welsonjs-bad1b2c/lib/groq.js:18console.log("Groq (GroqCloud) API KEY:", apikey);

code evidence v0.2.7.57 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

shell gnh1201-welsonjs-bad1b2c/app/assets/js/core-js-3.38.0.minified.js :10 var n=e(46),o=e(20),i=e(353);t.exports=function(t,r){var e;return n(t),o(r)&&r.constructor===t?r:((0,(e=i.f(t)).resolve)(r),e.promise)}},function(t,r,e){var n=e(3),o=e(8),i=e(30),a=e(353),u=e(350),c=e
shell gnh1201-welsonjs-bad1b2c/app/assets/js/core-js-3.49.0.wsh.js :979 return !!exec();
shell gnh1201-welsonjs-bad1b2c/lib/registry.js :144 function execFile(FN) {

net gnh1201-welsonjs-bad1b2c/app/assets/js/core-js-3.38.0.minified.js :14 ;break;case"EvalError":case"RangeError":case"ReferenceError":case"SuppressedError":case"SyntaxError":case"TypeError":case"URIError":a=new(c(i));break;case"CompileError":case"LinkError":case"RuntimeErr
net gnh1201-welsonjs-bad1b2c/app/assets/js/core-js-3.49.0.wsh.js :29140 fetch: function fetch(input /* , init */) {
net gnh1201-welsonjs-bad1b2c/lib/system.js :65 return WMI.execQuery("SELECT Caption FROM Win32_OperatingSystem").fetch().get("Caption").trim();
net gnh1201-welsonjs-bad1b2c/testloader.js :76 var result = WMI.execQuery(queryString).fetch().get("Caption").trim();