Jshook MCP Server

In the server's implementation (`dist/CodeAnalyzerDataFlow-BFZKjWj7.mjs:2`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ption:`Critical: Use of eval() allows arbitrary code execution`,recommendation:`Refactor to avoid eval(). Use JSON.parse

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/CodeAnalyzerDataFlow-BFZKjWj7.mjs

In the server's implementation (`dist/ConsoleMonitor-DXoeBkQ8.mjs:182`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: le.log('[ScriptMonitor] eval() called with code:', typeof code === 'string' ? code.substring(0, 100) + '...'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ConsoleMonitor-DXoeBkQ8.mjs

In the server's implementation (`dist/VersionDetector-D5zQqu4-.mjs:4`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return Boolean(new Function("return %HaveSameMap({}, {})")()); } catch (error) { retu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/VersionDetector-D5zQqu4-.mjs

In the server's implementation (`dist/browser-tvZZ2h6y.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return{evaluateFunction:Function(`return ${n}`)(),wasWrapped:!0,originalCode:t}}function Ee(e){return`(function() {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/browser-tvZZ2h6y.mjs

In the server's implementation (`dist/definitions-0mtilYzG.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ion compiled in-page as new Function("value", src); truthy result flips metadata.enabled=false. Hook code must call wind

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/definitions-0mtilYzG.mjs

In the server's implementation (`dist/definitions-CG9v4Hs4.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nWorldEval`,`Main world eval (camoufox)`,{default:!0}).openWorld()),t(`camoufox_server`,e=>e.desc(`Start, close, or chec

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/definitions-CG9v4Hs4.mjs

In the server's implementation (`dist/generated-tool-catalog-BH9z80Ip.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ion compiled in-page as new Function("value", src); truthy result flips metadata.enabled=false. Hook code must call wind

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/generated-tool-catalog-BH9z80Ip.mjs

In the server's implementation (`dist/handlers-CbJBP1gR.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: a;t._stubBump=a+8;let s=Function(`ctx`,` try { const result = (function(ctx) { ${i} })(ctx);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-CbJBP1gR.mjs

In the server's implementation (`dist/hooks-DH_aDkaH.mjs:1`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ?`__m.unhookPredicate = new Function('value', ${JSON.stringify(t.unhookPredicate)});`:``,i=JSON.stringify(e);return`(fun

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/hooks-DH_aDkaH.mjs

In the server's implementation (`dist/modules-Bm1ltsu_.mjs:323`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n`]=.8,i.push(`Multiple eval() calls`),a.push(`Hook eval() and log arguments`)),this.detectBase64Encoding(e)&&(n.push(`b

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/modules-Bm1ltsu_.mjs

In the server's implementation (`dist/NativeMemoryManager.impl-lKVm94wm.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ort{exec as l}from"node:child_process";async function u(e){if(process.platform===`darwin`)return d(e);if(process.platfor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/NativeMemoryManager.impl-lKVm94wm.mjs

In the server's implementation (`dist/ToolProbe-KJMecYBh.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as n}from"node:child_process";const r=t(n);async function i(t,n=[`--version`],i=e){try{let e=process.platform==

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/ToolProbe-KJMecYBh.mjs

In the server's implementation (`dist/TurboFanTraceCollector-4DFOQEo3.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt{spawn as l}from"node:child_process";function u(e){return!e||typeof e!=`object`?null:{sourceId:typeof e.sourceId==`num

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/TurboFanTraceCollector-4DFOQEo3.mjs

In the server's implementation (`dist/binary-instrument-DMVcUvqu.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as E}from"node:child_process";var D=class{sessions=new Map;activeSessionId;fridaProbe;probePromise;async attach

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/binary-instrument-DMVcUvqu.mjs

In the server's implementation (`dist/handlers-BlKk_NbV.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ";import*as d from"node:child_process";var f=class{disasm=new s;async findGadgets(e,t,n={}){let{maxDepth:r=5,maxGadgets:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-BlKk_NbV.mjs

In the server's implementation (`dist/handlers-C9tEeGSe.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n:n}=await import(`node:child_process`);return new Promise((r,i)=>{let a=n(`strace`,[`-p`,String(e),`-f`,`-yy`,`-X`,`ver

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-C9tEeGSe.mjs

In the server's implementation (`dist/handlers-GDOVxeSa.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: I,spawn as ne}from"node:child_process";var re=class{filter;lines=[];pending=``;constructor(e){this.filter=e}pushChunk(e)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-GDOVxeSa.mjs

In the server's implementation (`dist/handlers-XMcVNNHY.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: I,spawn as ge}from"node:child_process";import{open as _e}from"yauzl";var ve=class{generateHooks(e){let t=[];for(let n of

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-XMcVNNHY.mjs

In the server's implementation (`dist/maintenance-CKfITT20.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execFile as j}from"node:child_process";const M=A(j),N=S(import.meta.url);let P=null,F=0;function ae(){let e=Date.now();r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/maintenance-CKfITT20.mjs

In the server's implementation (`dist/modules-Bm1ltsu_.mjs:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e,spawn as ce}from"node:child_process";import*as k from"@babel/parser";import A from"@babel/traverse";import"@babel/gene

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/modules-Bm1ltsu_.mjs

In the server's implementation (`dist/platform-BPU-Y2NA.mjs:4`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ;try{let e=(await(await fetch(`http://${r}/json`,{signal:AbortSignal.timeout(5e3)})).json()).find(e=>e.type===`page`);if

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/platform-BPU-Y2NA.mjs

In the server's implementation (`dist/handlers-DyoToQTg.mjs:1`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ate.now()));let i=await import(r.href),a=T(i)?i:{};return t.status=`loaded`,this.loadedPlugins.set(e,{manifest:t,exports

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/handlers-DyoToQTg.mjs

In the server's implementation (`dist/proxy-BSp4i5bs.mjs:2`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: backScript.path,r=await import(n);if(typeof r.beforeRequest==`function`&&(t.beforeRequest=r.beforeRequest),typeof r.befo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/proxy-BSp4i5bs.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/postinstall.cjs:20`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ULES) { try { require(mod); } catch (err) { const msg = err && err.message ? err.message : '';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/postinstall.cjs

"@jshookmcp/jshook" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.cjs

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package @jshookmcp/jshook