{"id":5600,"name":"jervis","author":"Zihad","framework":"goat","overall":30,"grade":"F","level":"danger","verdict":"Dangerous — do not install without a full manual review","scores":{"security":0,"privacy":76,"quality":100,"maintenance":100,"community":0},"counts":{"critical":1,"high":2,"medium":3,"low":4},"alerts":[{"id":"remote-eval","severity":"critical","category":"security","title":"Downloads data and runs dynamic code","description":"The file makes network requests AND executes dynamically built code. This pairing is how remote-controlled backdoors are written.","count":1,"locations":[{"line":663,"snippet":"const r = Function(`\"use strict\"; return (${calcText})`)();"}]},{"id":"eval","severity":"high","category":"security","title":"Dynamic code execution","description":"Runs code that is built at runtime (eval, new Function, vm). This is the most common way malicious payloads are hidden in scripts.","count":1,"locations":[{"line":663,"snippet":"const r = Function(`\"use strict\"; return (${calcText})`)();"}]},{"id":"shell","severity":"high","category":"security","title":"Shell access","description":"Spawns operating-system processes through child_process. A command running shell code can read or change anything the bot's account can.","count":1,"locations":[{"line":7,"snippet":"const { exec } = require(\"child_process\");"}]},{"id":"fs-destructive","severity":"medium","category":"security","title":"Deletes files","description":"Calls fs.rm / unlink / rmdir. Check what path it deletes and whether a user can influence it.","count":1,"locations":[{"line":702,"snippet":"if (out.cleanup) setTimeout(() => fs.unlink(out.cleanup, () => {}), 30000);"}]},{"id":"process-control","severity":"medium","category":"security","title":"Can shut down the bot","description":"Calls process.exit / process.kill / process.abort, so one command can stop the whole bot.","count":1,"locations":[{"line":559,"snippet":"setTimeout(() => process.exit(2), 1500);"}]},{"id":"paste-host","severity":"medium","category":"privacy","title":"Fetches from a paste site or link shortener","description":"Content behind a paste/shortener link can be swapped out by its owner at any time.","count":1,"locations":[{"line":404,"snippet":"const r = await get(\"https://is.gd/create.php\", { format: \"simple\", url: m[2] });"}]},{"id":"fs-access","severity":"low","category":"security","title":"Filesystem access","description":"Reads or writes files on the machine running the bot.","count":1,"locations":[{"line":4,"snippet":"const fs = require(\"fs\");"}]},{"id":"ip-lookup","severity":"low","category":"privacy","title":"Looks up the host's public IP","description":"Queries an IP-echo service, which reveals where the bot is hosted.","count":1,"locations":[{"line":470,"snippet":"const d = await get(`http://ip-api.com/json/${m[1]}`);"}]},{"id":"hardcoded-ip","severity":"low","category":"privacy","title":"Hard-coded IP address","description":"Talks to a raw IP address instead of a named host — harder to audit and easy to redirect.","count":1,"locations":[{"line":279,"snippet":"info: \"🌍 তথ্য\\n• আবহাওয়া ঢাকা • নামাজের সময় • hijri\\n• btc price • 100 usd to bdt\\n• country Bangladesh • github torvalds • ip 8.8.8.8\\n• define love • tr…"}]},{"id":"network","severity":"low","category":"privacy","title":"Network access","description":"Makes HTTP/WebSocket requests. Check where the data goes.","count":1,"locations":[{"line":6,"snippet":"const axios = require(\"axios\");"}]}],"capabilities":[{"id":"network","label":"Network","active":true},{"id":"filesystem","label":"Filesystem","active":true},{"id":"shell","label":"Shell","active":true},{"id":"env","label":"Env vars","active":false},{"id":"eval","label":"Dynamic code","active":true},{"id":"credentials","label":"Session data","active":false},{"id":"install","label":"Installs packages","active":false},{"id":"process","label":"Process control","active":true}],"checks":[{"label":"Exports a command/module","ok":true},{"label":"Handles errors (try/catch or .catch)","ok":true},{"label":"Readable, not minified","ok":true},{"label":"Has explanatory comments","ok":true},{"label":"No deprecated dependencies","ok":true},{"label":"Reasonable size (< 200 KB)","ok":true}],"dependencies":{"builtin":["child_process","crypto","fs","os","path"],"external":["axios"],"local":[]},"domains":["api.adviceslip.com","api.aladhan.com","api.alquran.cloud","api.coingecko.com","api.dictionaryapi.dev","api.github.com","api.groq.com","api.qrserver.com","api.thecatapi.com","dog.ceo","generativelanguage.googleapis.com","google.com","image.pollinations.ai","ip-api.com","is.gd","meme-api.com","open.er-api.com","pokeapi.co","restcountries.com","text.pollinations.ai","translate.google.com","translate.googleapis.com","uselessfacts.jsph.pl","wttr.in"],"scannedAt":"2026-11-05T13:08:21.865Z"}