– No. It's a single-file app, but it needs PHP to run, so it can't open straight from disk in a browser.
✓ No leaked credentials (detect-secrets)
✓ Semgrep security-audit ruleset
✓ Semgrep javascript ruleset
✓ eval() usage
✓ Function() construction
✓ decode→eval chain
✓ document.write of decoded content
✓ sendBeacon usage
✓ decoded content DOM injection