Cute idea! The checks seem to be running entirely on the client side, so for instance the following will pass all test cases

    function isEvenNumber(num) {
      return challenge.testcase[1];
    }

or even

    this[challenge.fnName] = _ => challenge.testcase[1];

Depending on the use case, though, you could just say that anyone who can use the debugger to figure out how to hack around the captcha passes the test :)

Edit: oh, I see, it submits the code to be evaluated on the server after it passes on your browser (but the above causes the server to 500 at you, so it just says "Passed! Submitting..." and gets stuck in that state). Seems a bit dangerous to trust the client to control what code runs on your server, but I suppose platforms like leetcode manage it so in principle it should be possible to do safely.