Version loading…

Runtime side-effect analysis

Console activity monitor

A live experiment that watches for side effects often left by DevTools snippets, CDP evaluations, browser extensions, and injected automation. Signals are evidence to investigate, not proof that a visitor is a bot.

Risk level none
Observed events 0
Unique signals 0
Last activity none

Observe consequences, not the console itself

Page JavaScript has no standard event that announces “someone evaluated a console command.” The monitor therefore combines independent traces that evaluated code may leave behind. A finding becomes more useful when several unrelated approaches agree.

Persistent runtime traces

These checks look for changes that remain observable after an evaluated expression has finished.

01

Global surface changes

The page snapshots every own key and descriptor on globalThis, then checks for additions, removals, assignments, and descriptor changes. Suspicious automation-like names receive stronger weighting.

window.foo deleted globals descriptor changes
dummy link
02

Console call provenance

Console methods are wrapped while their original behavior is preserved. Calls record method, argument types, and a sanitized stack classification. Anonymous, evaluated, blob, data, and extension sources are more interesting than this page’s URL.

<anonymous> eval / VM scripts console.clear
dummy link
03

Console and API integrity

Periodic integrity checks notice replaced console wrappers and changes to observation-critical APIs such as Reflect.ownKeys, MutationObserver, eval, and the Function constructor.

method replacement no-op suppression API tampering
dummy link
04

Unhandled execution failures

Capturing listeners retain sanitized metadata for uncaught errors, failed script resources, and unhandled promise rejections. Their source and stack are classified with the same provenance rules used for console calls.

error unhandledrejection resource failure
dummy link

Injection and inspection traces

These checks watch browser surfaces commonly touched when custom code is introduced or inspected.

05

Executable DOM injection

A mutation observer identifies new scripts, frames, styles, embedded content, event-handler attributes, and other DOM edits. Inline code is represented only by length and a small fingerprint; its contents are not copied into the report.

script nodes inline handlers unexpected DOM
dummy link
06

Late script resources

Resource Timing observes scripts fetched after startup. This complements DOM observation when a node changes too quickly or another loader mediates the request, while retaining a URL with query strings and fragments removed.

resource timing blob / data URLs cross-origin scripts
dummy link
07

Policy violations

If the hosting environment supplies Content Security Policy, the standardized securitypolicyviolation event can reveal blocked eval, inline code, or foreign script attempts. The endpoint does not claim a policy exists when it does not.

script-src blocked URI effective directive
dummy link
08

Inspector canary

The page logs a harmless object with an accessor canary through the saved native console method. If a debugger or automation client deliberately reads that accessor, the interaction is recorded as low-confidence inspection evidence.

object preview accessor read CDP inspection
dummy link

What remains invisible

The endpoint deliberately avoids timing traps, debugger pauses, viewport guesses, user-agent checks, and other broad fingerprinting. It also cannot turn absence of evidence into proof of a clean session.

  • A read-only expression such as 2 + 2 can leave no page-visible trace.
  • Console-scoped let, const, and class bindings are not own window properties.
  • Code installed before this page’s monitor can become part of the baseline.