PDF JavaScript rebuilds eval from character pieces

PDF_EVAL matches the literal token eval(, so exploit kits stop writing it: they build the name at run time out of one-character strings and array elements, e.g. g[a[0]+'v'+a[1]+'l'], and the identifier never appears in the file. This rule keys on the RECONSTRUCTED name rather than on how much the code concatenates — benign minified JavaScript concatenates a great deal more, so density would separate nothing, while no legitimate code has a reason to spell a built-in this way. Rated HIGH: decisive in context alongside the JavaScript and model signals, but not a conviction on its own.