  Writing desktop applications in JavaScript offers developers the opportunity
to write cross-platform applications with cutting edge capabilities. However in
doing so, they are potentially submitting their code to a number of
unsanctioned modifications from malicious actors. Electron is one such
JavaScript application framework which facilitates this multi-platform
out-the-box paradigm and is based upon the Node.js JavaScript runtime --- an
increasingly popular server-side technology. In bringing this technology to the
client-side environment, previously unrealized risks are exposed to users due
to the powerful system programming interface that Node.js exposes. In a
concerted effort to highlight previously unexposed risks in these rapidly
expanding frameworks, this paper presents the Mayall Framework, an extensible
toolkit aimed at JavaScript security auditing and post-exploitation analysis.
The paper also exposes fifteen highly popular Electron applications and
demonstrates that two thirds of applications were found to be using known
vulnerable elements with high CVSS scores. Moreover, this paper discloses a
wide-reaching and overlooked vulnerability within the Electron Framework which
is a direct byproduct of shipping the runtime unaltered with each application,
allowing malicious actors to modify source code and inject covert malware
inside verified and signed applications without restriction. Finally, a number
of injection vectors are explored and appropriate remediations are proposed.
