js-reverse-automation

SUSPICIOUS: the dependency provenance is mostly coherent, but the skill's actual footprint is high-risk because it equips an AI agent to perform web reverse-engineering and produce injection/proxy tooling for bypassing browser-side protections. This is not confirmed malware, but it is a high-risk offensive-security skill with meaningful misuse potential.

This module is a highly suspicious runtime interception tool that monkey-patches global Function.prototype.apply/call and wraps CryptoJS/JSEncrypt crypto/hash operations to dump cryptographic secrets. It logs symmetric keys/IV/ciphertext, hash/HMAC inputs and digests, and—critically—RSA private keys and decrypted plaintext. Even without explicit network exfiltration in the snippet, the console output constitutes a direct secret-recovery capability, making the security risk extreme for any real application context.

This module is a high-risk WebSocket RPC client because it includes a built-in action ('_execjs') that performs eval(param) where param is derived from untrusted network messages. The remote peer can select actions via the incoming 'action' field and can receive the evaluated result back over the WebSocket, creating a remote code execution capability in the client runtime. While no explicit file/network exfiltration beyond the WebSocket response is shown, the eval-based design itself is sufficient to treat this as a serious security concern for supply-chain usage.

This module is a browser-side defense-evasion/anti-debugging utility. It globally hooks `eval` and `Function`-related constructors to strip `debugger` statements from dynamically executed code, and it spoofs `Function.prototype.toString` to hinder integrity or anti-tamper checks. While it does not show explicit data theft or exfiltration, it substantially changes global execution behavior and is therefore a meaningful security risk, especially in a supply-chain dependency context.

This module is a browser-side monkey-patch that overrides window.close, history back/go, and sets an onbeforeunload handler that triggers a debugger and returns false. It does not demonstrate data theft or network exfiltration within the fragment, but it significantly alters navigation and page lifecycle behavior and can be used to bypass or neutralize navigation/defense logic. In a supply-chain context, it should be treated as suspicious behavior-change code unless strict injection scope and legitimate debugging intent are verified.

This module is a deliberate environment-spoofing hook that overwrites window dimension properties to influence webpage anti-DevTools/automation detection logic. It does not display classic malware behaviors (exfiltration/persistence/command execution) in this fragment, but it is clearly designed to evade or distort client-side environment checks. The principal security concern is misuse to bypass safety/risk controls and to mislead diagnostics/telemetry.