No debugger I use shows any such props
Then there is no such thing, assuming those host objects are not implemented as Proxies.
Your approach of enumerating properties with a for-in-loop (and even heavier weapons such as Object.getOwnPropertyNames
and Object.getPrototypeOf
) is flawed, as anything visible like that would be shown in your debugger.
If you really want to find "hidden" properties (I'm very sure there are none), you would need to brute-force test all possible property names. Or have a look into their source, which might be hidden from you if it's a host object.