1. A computer program product tangibly embodied on non-transient computer readable media, the computer program product comprising instructions operable when executed to: execute script code by a script application programming interface (API); detect, by a decoder, an event in the script code, the event comprising one of a memory call or an indirect branch call; redirect an instruction pointer to a predetermined memory location, the predetermined memory location comprising malware monitoring code; execute the malware monitoring code upon execution of a script application programming interface (API) redirection of the instruction pointer to the predetermined memory location; identify, in a heap memory, script code loaded into the heap memory; and evaluate, by the malware monitor, the script code in the heap memory for malicious code prior to execution of the script code.