js-reverse-automation

SUSPICIOUS：来源依赖总体可验证，未见明显凭据窃取或伪装安装器；但技能声明与实际能力都集中在前端加密逆向、脚本注入、代理生成和 Burp 集成，属于高风险攻防/利用型 AI 技能，不适合作为普通开发辅助技能放宽信任。

This fragment is a global RSA debugging/instrumentation hook, not normal cryptographic-library behavior. It deliberately exposes private RSA keys, plaintext, ciphertext, and decrypted data through console logging and alters Function.prototype.call globally. Although no direct network exfiltration or system compromise is shown, the key and plaintext disclosure creates a serious security risk. It could be legitimate reverse-engineering or debugging code, but its placement in a dependency would be unsafe unless explicitly intended and tightly controlled.

The code is a WebSocket RPC client with an intentionally exposed eval-based _execjs command. Any party able to control or compromise the configured WebSocket endpoint, or otherwise inject messages into the connection, can execute arbitrary JavaScript in the client context and receive results. This is a critical security risk unless the endpoint is fully trusted and the feature is deliberately intended for controlled development tooling. The fragment shows no direct credential theft, exfiltration domain, persistence mechanism, or destructive behavior, but the eval sink enables those actions indirectly.