js hook toolkit that all you need
D high
- vulnerabilities attested + 7
- capability exposure inferred + 35
- recent drift inferred + 20
- tool safety inferred + 12
attested inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 4m ago · see ecosystem CVEs →
- D · 67 → D · 74
- C · 59 → D · 67
- A · 0 → C · 59
Inferred surface — each links to servers holding it:
MEDIUM
ICMP probe and traceroute skip local-network SSRF authorization
- high dangerous code
committed secret: private key · dynamic exec: new Function(), eval(), indirect eval, setTimeout(string), constructor escape
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 22fb441 · analyzer v28 · 3d ago
danger signals39
- dynamic code execution new Function() vmoranv-jshookmcp-22fb441/src/modules/collector/DOMInspector.ts :108
new Function( - dynamic code execution eval() vmoranv-jshookmcp-22fb441/src/modules/v8-inspector/JITInspector.ts :136
const candidate = eval(${JSON.stringify(functionRef)}); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/src/modules/v8-inspector/VersionDetector.ts :103
return Boolean(new Function("return %HaveSameMap({}, {})")()); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/src/server/domains/browser/handlers/safe-code-transform.ts :83
const evaluateFunction = new Function(`return ${functionString}`)() as () => unknown; - dynamic code execution indirect eval vmoranv-jshookmcp-22fb441/src/server/domains/browser/handlers/safe-code-transform.ts :111
return (0, eval)(${escapedCode}); - dynamic code execution indirect eval vmoranv-jshookmcp-22fb441/src/server/domains/process/handlers/injection-handlers.ts :498
const result = (0, eval)(expression); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/analyzer/CodeAnalyzer.test.ts :89
eval(payload); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/analyzer/CodeAnalyzerDataFlow.interprocedural.test.ts :37
eval(w); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/analyzer/CodeAnalyzerDataFlow.test.ts :38
eval(source); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/analyzer/CodeAnalyzerDataFlow.test.ts :93
new Function(netSource); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/analyzer/SecurityCodeAnalyzer.test.ts :63
eval(payload); - dynamic code execution setTimeout(string) vmoranv-jshookmcp-22fb441/tests/modules/analyzer/SecurityCodeAnalyzer.test.ts :121
setTimeout('alert(1)', 0); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/captcha/CaptchaDetector.callbacks.extra.test.ts :33
const runner = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/captcha/CaptchaDetector.coverage.test.ts :26
const runner = new Function( - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/collector/PageController.test.ts :555
return eval(pageFunction); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/deobfuscator/webcrack.benchmark.test.ts :46
new Function(code); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/detector/ObfuscationDetector.coverage.extra.test.ts :68
eval(function(p,a,c,k,e,d){return p;}); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/detector/ObfuscationDetector.test.ts :133
const factory = new Function("return 1"); - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/modules/detector/ObfuscationDetector.test.ts :136
const packed = eval(function(p,a,c,k,e,d){return p;}); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/emulator/EnvironmentEmulatorFetch.coverage.test.ts :84
const runner = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/stealth/StealthVerifier.coverage.test.ts :23
const runner = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/modules/stealth/StealthVerifier.test.ts :163
const wrappedFn = new Function( - dynamic code execution eval() vmoranv-jshookmcp-22fb441/tests/server/domains/analysis/ast-and-deflat.test.ts :51
eval("console.log('hello')"); - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/server/domains/browser/font-fingerprint.test.ts :13
const fn = new Function(...keys, 'document', 'queryLocalFonts', 'return (' + script + ');'); - dynamic code execution constructor escape vmoranv-jshookmcp-22fb441/tests/server/domains/browser/page-evaluation.security.test.ts :174
Function.prototype.constructor.constructor('return process')() - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/server/domains/canvas/adapters/babylon-adapter.test.ts :121
const fn = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/server/domains/canvas/adapters/three-adapter.test.ts :177
const fn = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/server/domains/canvas/canvas.coverage.test.ts :361
const evaluator = new Function( - dynamic code execution new Function() vmoranv-jshookmcp-22fb441/tests/server/domains/canvas/handlers.test.ts :39
const evaluator = new Function( - suspicious endpoint google-analytics.com (telemetry) vmoranv-jshookmcp-22fb441/tests/modules/analyzer/PatternDetector.additional.test.ts :162
makeRequest({ url: 'https://google-analytics.com/collect' }), - suspicious endpoint google-analytics.com (telemetry) vmoranv-jshookmcp-22fb441/tests/modules/analyzer/PatternDetector.test.ts :333
request({ requestId: 'blacklisted', url: 'https://google-analytics.com/collect' }), - suspicious endpoint 169.254.169.254 (cloud metadata) vmoranv-jshookmcp-22fb441/tests/server/domains/graphql/runtime-replay.test.ts :108
endpoint: 'http://169.254.169.254/graphql', - suspicious endpoint 169.254.169.254 (cloud metadata) vmoranv-jshookmcp-22fb441/tests/server/domains/graphql/runtime-subscribe.test.ts :273
endpoint: 'http://169.254.169.254/graphql', - suspicious endpoint 93.184.216.34 vmoranv-jshookmcp-22fb441/tests/server/domains/network/replay-additional.test.ts :678
url: 'https://93.184.216.34/api', - suspicious endpoint 8.8.8.8 vmoranv-jshookmcp-22fb441/tests/server/domains/network/ssrf-policy.test.ts :358
const target = await resolveNetworkTarget('http://8.8.8.8/path'); - suspicious endpoint 169.254.169.254 (cloud metadata) vmoranv-jshookmcp-22fb441/tests/server/domains/sourcemap/handlers.impl.sourcemap-parse-base.test.ts :146
'http://169.254.169.254', - suspicious endpoint 169.254.169.254 (cloud metadata) vmoranv-jshookmcp-22fb441/tests/server/domains/sourcemap/handlers.test.ts :222
sourceMapUrl: 'http://169.254.169.254/meta.map', - suspicious endpoint 93.184.216.34 vmoranv-jshookmcp-22fb441/tests/server/domains/workflow/network-policy.coverage.test.ts :332
const result = await authorizeWorkflowUrl('https://93.184.216.34/', defaultPolicy, { - committed secret private key vmoranv-jshookmcp-22fb441/scripts/runtime-probes/constants.mjs :29
PEM private key block (redacted)
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/github:vmoranv/jshookmcp/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of vmoranv.