PostgreSQL: How find functions that use sys_eval
You can't find where sys_eval is used in our existing code, because this function does not exist on a clean system (unless you have gone out of your way to make it) so your code would have no reason to use it (unless of course your code-base was also hacked and had stuff inserted into it).  The function was created by the hacker as one of the steps of hacking your database.  The hacker could have called it anything he wanted.  He probably got the code here or similar, and then was too lazy to obfuscate the names.

If you are looking for where it is on the poisoned system, look in pg_proc.  But this system needs to be nuked from orbit, so there is probably no point in looking.  The changes you will make (on your clean system) to pg_hba, the firewall, and the database users (including the database superusers, which is where the hack happened, not just the ordinary users) should prevent them from exploiting the new system, but there is no way of telling how many trojans and backdoors were installed in the old one.