Monkey-patching/polyfill detector

README.md

This script tries to detect monkey-patching, polyfills and other hacks/overrides in the browser.

Paste it into the Chrome (or Edge) console and press ENTER.

Note that this may give false positives for window.location, window.fetch and window.length - this appears to be because these properties aren't correctly reflected by the native browser implementations, but if you know how to fix that, please post a comment.

test.js

(() => {
  const iframe = document.createElement('iframe');

  iframe.src = 'javascript:;';

  document.getElementsByTagName('body')[0].appendChild(iframe);

  nativeWindow = iframe.contentWindow;

  const seen = new Set();

  function check(parent, nativeParent, prefix, deep) {
    for (const name of Object.getOwnPropertyNames(parent)) {
      const key = `${prefix}.${name}`;

      if (seen.has(key)) continue;

      seen.add(key);

      try { parent[name].toString(); nativeParent[name].toString(); } catch { continue }

      const getter = Object.getOwnPropertyDescriptor(parent, name).get;
      const nativeGetter = Object.getOwnPropertyDescriptor(nativeParent, name).get;

      if (nativeGetter ? getter.toString() !== nativeGetter.toString() : parent[name].toString() !== nativeParent[name].toString()) {
        console.log(`⚠ ${key}`, nativeGetter ? { getter, nativeGetter } : { value: parent[name], nativeValue: nativeParent[name] });

        if (deep && parent[name].prototype) {
          check(parent[name].prototype, nativeParent[name].prototype, name);
        }
      }
    }
  }

  check(window, nativeWindow, "window", true);

  iframe.parentNode.removeChild(iframe);
})();