Dynamic executionhigh severity

Obfuscated Eval Loader

Code decodes strings at runtime and executes them dynamically, hiding the actual behavior from a quick source review.

How the pattern works

The source file does not show the real program directly. Instead, it stores encoded text and rebuilds executable code at runtime.

That rebuilt code may be passed to eval(), Function(), or another dynamic execution path. In malicious repos, this often sits close to startup so the payload runs as soon as the developer starts the project.

Why it is effective

Obfuscation attacks the review process. A developer scanning the repo sees noise, helper names, or generic setup code instead of the actual behavior.

Empty error handling makes the pattern harder to notice during testing. If the payload fails, the app may still appear broken or ordinary rather than loudly suspicious.

What to check

Search for dynamic execution and work backward. Ask what string is being executed, where it came from, and why it could not be normal source code.

Legitimate uses exist, but unknown repos should not need hidden runtime code generation to start a web app.