Idle Light City - City Management Simulation Game

The extension wraps the native eval() function with a custom interceptor (evalx) that silently rewrites any code string before execution: it replaces Poki's base64-encoded sitelock URL (`https://poki.com/sitelock`) with a fragment identifier (`#ubg235`) and redirects location references to a spoofed proxy. This is intentional DRM circumvention code, enabling a game that was licensed exclusively for poki.com to run inside the extension without authorization from the game's publisher (No PowerUp Studios) or Poki. While it does not exfiltrate user data, the use of eval() interception to silently rewrite runtime code is a meaningful red flag.

var originalEval = eval;evalx = function() {  // consoleLog("--fx--eval--", arguments);  // debugger;  // return;  arguments[0] = arguments[0].replace("aHR0cHM6Ly9wb2tpLmNvbS9zaXRlbG9jaw==", "I3ViZzIzNQ==");  arguments[0] = arguments[0].replace("'location'", "'xlocation'");  return originalEval.apply(this, arguments);}

A Proxy object is used to intercept all property accesses on `window.location`, returning spoofed values (hostname=`localhost`, href/origin=`https://localhost/`) instead of the real extension origin. Combined with the eval interceptor above, this completes the domain-spoofing bypass: the game's runtime sitelock check reads `location.hostname` and sees `localhost` rather than the extension origin, allowing the DRM-protected game to run without a valid license. This pattern of location spoofing is atypical for legitimate game extensions.

xlocation = new Proxy(location, {  get: function(target, property, receiver) {    consoleLog("--fx--xlocation--get--property--", property);    let targetObj = target[property];    if (typeof targetObj == "function") {      return (...args) => target[property].apply(target, args);    } else {      if (property == "host" || property == "hostname") {        return "localhost";      }      if (property == "href") {        return "https://localhost/";      }      if (property == "origin") {        return "https://localhost/";      }      return targetObj;    }  },  set: function(target, property, receiver) {    consoleLog("--fx--xlocation--set--property--", property, receiver);    return true;  }});