browser-tools
Warn
Audited by Socket on Jul 11, 2026
1 alert found:
AnomalyAnomalyscripts/eval.mjs
LOWAnomalyLOW
scripts/eval.mjs
This module is an intentional CLI-to-browser-page eval bridge: it takes arbitrary JavaScript from command-line arguments and executes it inside the target page via `page.evaluate` + `AsyncFunction`, then prints the returned value(s). That capability is inherently high-risk for data exposure if the CLI input is untrusted or if the page has sensitive content. No classic malware behaviors (persistence, credential theft, filesystem/network actions) are evident in this snippet itself, but overall security risk remains elevated due to unsafe dynamic code execution design and reliance on `browser-control.mjs` for session/target handling.
Confidence: 66%Severity: 65%
Audit Metadata