JS Global Detection: Finding Libraries by Their window Variables

## Why it matters

Many modern frameworks leave almost nothing in the static HTML but define a telltale global at runtime. A single-page app might have no visible <script> tags and no meta tags, but it'll have window.__NEXT_DATA__ or window.Vue. This is often the only vector that catches frameworks that bundle their code and strip version strings.

JS globals require running in the page's MAIN world: an isolated content script can't see these globals, which is why detection runs as a bounded, second-pass probe after the static HTML scan.

## How it works

Scalpel Stack maintains a fixed list of dot-paths to check: React, Shopify, jQuery.fn.jquery, __NEXT_DATA__, and dozens more. For each path, it attempts to walk the property chain in the page's JavaScript world inside a try-catch, so a missing intermediate property never throws an error.

If a path resolves to a defined value (not undefined or null), the library is confirmed. The value itself is sometimes inspected for a version number: for example, window.jQuery.fn.jquery contains the exact jQuery version.

The list is fixed and bounded: the probe does not enumerate all properties on window and it does not use eval. This keeps the scan safe from malicious pages trying to overload the extension.

## What does not matter

A global can be deleted or renamed by the page, so its absence proves nothing. Some libraries define their global behind a check (e.g. if no module system is present), so a page might load React but not expose window.React.

Minified code can obscure the global name or wrap it in a closure. A library might be present in the bundle but not instantiated, so the global never gets created.

## Code example

A Next.js site running on the page will have:

window.__NEXT_DATA__
// Outputs: { isPreview: false, page: "/", ... }
Copy

A jQuery site will have:

window.jQuery.fn.jquery
// Outputs: "3.6.4"
Copy

A Shopify storefront will have:

window.Shopify
// Outputs: { shop: "myshop.myshopify.com", ... }
Copy

Scalpel Stack probes each dot-path and records the type of value that was found (object, string, number) without transmitting its contents.

## How Scalpel Stack shows it

Evidence lines using the js vector badge display the dot-path as the key (e.g. __NEXT_DATA__, jQuery.fn.jquery). If a version was extracted from the global, it appears on the same row. The matched text never includes sensitive data: only the type of value is recorded, not its content.

The probe runs as part of the initial tab scan and requires no user action.