js-covert-scan

JavaScript Covert-Tactics Scanner

Detect the tactics code uses to hide what it does in JavaScript/TypeScript, and emit atoms a caller can reason over. Static, read-only, pure-stdlib.

When to use

You suspect a file is doing something it doesn't advertise — behaving differently for some users, smuggling signal through text, or hiding strings/logic from a casual read or a strings dump. This scanner surfaces the tactics; it does not decide intent. Run it on a file or a whole package.

What it detects — real parallax atoms, tagged method="covert-scan"

Every finding is emitted as a judgment-free parallax atom with method: "covert-scan"; the downstream lens makes the obfuscation/evasion judgment from that provenance. The per-tactic note preserves exactly which hiding tactic was seen (so XFRM.UNICODE findings still say "bidi control char" vs "confusable homoglyph", and ENVI.ENVCHECK findings still say "timezone-conditional" vs "geolocation check").

XFRM.UNICODE — hidden in text you can't see or can't tell apart:

• zero-width / format / control characters (U+200B, U+FEFF, soft hyphen, word joiner, variation selectors, tag chars…).
• bidirectional control characters (the "Trojan Source" reordering attack: source that reads differently than it compiles).
• confusable characters standing in for ASCII: fancy apostrophes / quotes (e.g. U+2019 ’, U+02BC ʼ, U+02B9 ʹ), non-breaking / ideographic spaces, look-alike dashes, and Cyrillic/Greek/fullwidth letters posing as Latin.

XFRM.BITWISE — XOR of character codes (a common way to keep strings out of a plain strings dump).

XFRM.ENCODE — machine-hidden strings:

• strings assembled from String.fromCharCode(…) number lists.
• long \xNN / \uNNNN escaped string blobs.

LOAD.EVAL — eval(…) / new Function(…) dynamic execution.

ENVI.ENVCHECK — environment-keyed conditional behavior (act differently for specific victims / dodge analysis):

• timezone checks: Intl.DateTimeFormat().resolvedOptions().timeZone, timezone name literals.
• locale checks: navigator.language, resolved locale.
• geolocation / IP-geo checks.
• proxy / *_PROXY env checks.