[
  {
    "id": "EVAL001",
    "pattern": "\\beval\\s*\\(|new\\s+Function\\s*\\(",
    "flags": "",
    "category": "eval_abuse",
    "description": "eval abuse (direct and indirect)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "EVAL002",
    "pattern": "const\\s+\\w+\\s*=\\s*eval\\b|let\\s+\\w+\\s*=\\s*eval\\b|var\\s+\\w+\\s*=\\s*eval\\b",
    "flags": "",
    "category": "eval_abuse",
    "description": "eval abuse (direct and indirect)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "EVAL003",
    "pattern": "eval\\s*\\(\\s*atob\\s*\\(|eval\\s*\\(\\s*Buffer\\.from\\s*\\([^)]*base64",
    "flags": "i",
    "category": "eval_abuse",
    "description": "eval() fed an encoded/decoded payload (base64 atob/Buffer.from, hex, etc.)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "EVAL004",
    "pattern": "eval\\s*\\(\\s*\\w+\\.from\\s*\\(.*['\"]hex['\"]\\)",
    "flags": "i",
    "category": "eval_abuse",
    "description": "eval() fed an encoded/decoded payload (base64 atob/Buffer.from, hex, etc.)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "EVAL005",
    "pattern": "\\bexec\\s*\\(\\s*(?:code\\b|hook_code\\b|compile\\s*\\()",
    "flags": "",
    "category": "eval_abuse",
    "description": "Python: exec() with user-controlled code string",
    "language": [
      "python"
    ],
    "severity": "critical"
  },
  {
    "id": "EVAL006",
    "pattern": "_\\.template\\s*\\(\\s*(?:template|tpl)\\b",
    "flags": "",
    "category": "eval_abuse",
    "description": "TypeScript: lodash template compilation (code execution)",
    "language": [
      "typescript"
    ],
    "severity": "critical"
  }
]