@adguard/dnr-rulesets@4.1.20260722190044

High-risk behavior combination matched malicious policy.

A consuming browser extension applies the embedded local script rule on a matching page.

Potential exfiltration of page-derived API-key/link/form data to an untrusted destination.

Function-constructor proxy plus dynamic form-data POST

The packaged Chromium and Opera rulesets include an identical payload that hooks Function.prototype.constructor, detects code containing api_key, reads page values, decodes window.ext_site into a destination, builds FormData from intercepted HTML, and POSTs it. This is concrete page-context data forwarding, not merely a network-blocking rule.

The bundled rulesets contain a concrete credential/data forwarding chain in two target-browser artifacts. No install hook is needed for the payload to be harmful once a consumer loads these rules.