Now don't get me wrong, there are already other questions like this. But I'm looking into more of how an attack could actually be done.
Instance A: A hacker gains access to a web server / hosting. They make changes to files so that instead of the original code, malicious code will run.
Ok, so I think scenario has many obvious problems. Even if a hacker somehow managed to get into a server, why would they use eval() of all things when they have the entire code at their disposal, it would probably make more sense just to run malicious code on the server and modify the existing code anyway.
Instance B: A hacker gains access to an consumer's device, uses a saved password to log into the victim's account and proceeds to execute malicious code.
In this instance, eval() wouldn't make much sense, because they have the account already. Either use the interface (say transferring money from the victim to the hacker), or just execute code in the DevTools?
Instance C: A hacker uploads malicious code to a public forum site (like SQL Injection). When a user opens this site, the tags
<script></script> are inserted into the DOM rather than plain text.
Well as a general security measure, shouldn't all code be validated both on the client and on the server to make sure that code isn't being entered? Additionally, it's already a good practice to pass in data as plain text on client pages. This is just to raise the point that validation is important, not that eval() would be used. Because validation before any eval() is always important, so even if they used code as a string passed into eval() instead of inserting the code into the DOM using script tags, the code shouldn't even reach the database because the server should have validation anyway.
So in conclusion, I can't think of a scenario where eval() would be the best play for a hacker, as if they had access to that, I would assume that they would take better methods at their disposal (like modifying source and DevTools) rather than using eval().