website-rebuild

No direct evidence in this module of covert malware (e.g., reverse shell, persistence, or stealthy exfiltration) or intentional obfuscation. However, this is a high-capability probing tool: it executes untrusted JS in the loaded page via CDP Runtime.evaluate (--eval/--evalAfter), navigates to arbitrary attacker-controlled URLs, and writes screenshots to an operator-chosen filesystem path (--shot). If an attacker can influence CLI inputs, URL targets, or eval expressions, the misuse potential is significant (recon, induced browser-side actions, and unintended file overwrites).

No direct evidence of intentional malware (backdoor/exfiltration) in this snippet, but it contains a high-impact security hazard: it evaluates payload text extracted from untrusted remote HTML using new Function in the default expansion path. Additionally, it performs SSRF-prone fetches to user-supplied bases without allowlisting and may write attacker-controlled/remote payloads to disk when --dump is enabled. If the tool is ever run against attacker-influenced sites, the new Function evaluation can lead to arbitrary code execution in the Node.js process.

This code is a client-side “probe” shim that, when enabled via ?__probe, aggressively monkey-patches global browser APIs (time, RNG, timers/RAF, visibility/focus, and IntersectionObserver) and provides external control via window.__pump/__pumpTime and reseeding via window.__reseed. There is no direct evidence of data theft or network exfiltration in this snippet, but it is security-relevant because it makes time and randomness deterministic/predictable, which can undermine security logic if the host application relies on Math.random or timing for nonces/tokens/fingerprinting. Recommend auditing how/when this code is loaded and ensuring it cannot be triggered in production or used by untrusted actors.

This module is a high-risk automation/harvesting orchestrator rather than a self-contained malware sample. Its security-critical property is intentional arbitrary code execution: it dynamically imports a user-specified config, injects config-provided code fragments into a generated payload that uses eval(s.js), and executes that payload in a spawned Node probe process via a command-line '--eval' argument. If an attacker can influence --config, the contents returned by cfg.states(), or --probe, they can achieve arbitrary code execution and potentially harvest/store sensitive data (persisted to --out). In a trusted, tightly controlled workflow, it may be legitimate; in an untrusted supply-chain or user-input scenario, it should be treated as dangerous.

No explicit malicious payload is visible in this module itself (no hardcoded secrets or direct exfiltration), but it creates a strong execution-control pathway: it dynamically loads an arbitrary config module and injects cfg.build(cases) into an expression string passed to a probe subprocess via '--eval'. If the config/probe inputs are tampered with or untrusted, this design can enable arbitrary behavior in the probe context. Overall, treat as medium-to-high supply-chain security risk due to dynamic eval/payload injection architecture rather than clear evidence of malware in this file alone.

No explicit malware payload is evident in this module, but it strongly matches client-side telemetry/fingerprinting behavior: it harvests private animation metadata from the DOM (_animInfo), evaluates easing functions at fixed timestamps to create deterministic curve fingerprints, and derives identities via additional processing. It also includes a high-uncertainty integration point (window.__req with a hardcoded identifier) and returns executable code strings intended for later evaluation. The primary security concern is privacy/tracking and potential exfiltration/side effects handled outside this fragment by the runtime orchestration and window.__req implementation.

No direct evidence of malware (data theft, persistence, or destructive actions) is present in this file alone. The primary security concern is architectural: it dynamically imports a filesystem-configurable module (arbitrary code execution at import time) and passes config-derived content into a probe subprocess via a `--eval` argument (a high-impact RCE pathway if the probe interprets that argument). Additionally, the target URL is forwarded to the probe, so probe behavior may enable SSRF/external access depending on probe implementation. Treat config/probe inputs as fully trusted and ideally pin them; otherwise, the risk is significant.