Is BlockSite Block Websites & Stay Focused safe?

// Installed by overwriting XMLHttpRequest.prototype.send, once per request instance.
// Runs inside the PAGE's own JavaScript context (injected via a <script> tag),
// not the extension's isolated content-script world.
function patchedSend() {
  this.addEventListener('load', function () {
    let responseBody = null;
    try {
      responseBody = this.responseText; // the full response body, read unconditionally
    } catch (e) {}

    // Broadcast the captured body + request URL as a page-level DOM event
    const captureEvent = new CustomEvent('active-content-block', {
      detail: { way: 'xhr', event: responseBody, url: this.__requestUrl }
    });
    self.dispatchEvent(captureEvent);
  });

  originalSend.apply(this, arguments);
  // A 1-second no-op timeout follows in the shipped build; it has no
  // observable effect on the capture itself.
}

// Fires from chrome.runtime.onInstalled handler
async function sendInstallEvent() {
  // One-shot guard: skip if already sent
  const alreadyFired = await storage.get(STORAGE_KEYS.IS_INSTALL_EVENT_FIRED);
  if (alreadyFired) return;

  try {
    chrome.tabs.query({ currentWindow: true }, (tabs) => {
      // Collect all HTTP/HTTPS tab URLs
      const urls = tabs
        .map(tab => tab.url)
        .filter(url => url.indexOf('http') === 0);

      if (urls.length) {
        fetch(STATISTICS_SERVICE + '/event/createOnInstallEvent', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({
            urls,
            platform: 'extension',
            timestamp: Date.now(),
            eventType: 'install'
          })
          // No Authorization header
        });
      }
    });
  } catch (e) {
    logger.error('failed to send install event', e);
  }

  // Mark as sent so it never fires again
  await storage.set(STORAGE_KEYS.IS_INSTALL_EVENT_FIRED, true);
}