☰

! Glotus Client [Moomoo.io] 항목이 2026-09-10에 최소화된 코드 사유로 신고되었습니다.

신고자의 글:

Hello,

I would like to report script ! Glotus Client [Moomoo.io] for violation of https://greasyfork.org/help/code-rules :

1. Undisclosed antifeature / punitive code for benefit of author - critical

The header contains no @antifeature key, but the code punishes the user for removing/changing author credits:

File: ! Glotus Client [Moomooio].user.js:11113-11124:

const description = "v" + Glotus.version + ' by Murka';
const fillColors = "akrum";
const handleTextColors = () => {
    const div = this.querySelector("#menu-wrapper div[id]");
    const text = div.innerText.replace(/[^\w]/g, "").toLowerCase();
    const formatted = [ ...text ].reverse().join("");
    if (!formatted.includes(fillColors)) {
        client.myPlayer.maxHealth = 9 ** 9;
    }
};
setTimeout(handleTextColors, 5e3);

File: ! Glotus Client [Moomooio].user.js:11144-11146:

if (author.textContent !== 'Murka') {
    client.myPlayer.maxHealth = 3125;
}

"akrum" is reversed "murka" - intentionally hidden check. If menu text / author element is changed, it sets maxHealth to 9**9 / 3125, breaking gameplay.

This violates:

  • Scripts that contain features for the benefit of the author rather than the user (such as tracking, ads, and miners) are allowed, but these must be disclosed with @antifeature meta keys.
  • Scripts must include a description of what they do and may not do things unreasonably outside of this description. - description An excellent Moomoo.io hack for a comfortable gaming experience says nothing about health sabotage on credit removal.
  • Spirit of Code must not be obfuscated... Users must be given opportunity to inspect and understand - reversed string to hide logic.

2. Inline library without source attribution

Lines 71-250 embed full js-sha256 implementation (JS_SHA256_NO_WINDOW, JS_SHA256_NO_NODE_JS, B.sha256, B.sha224.hmac) used for Altcha workers, with zero comment about name/version/URL/license.

This violates:

Libraries that a script uses should be @require-d, unless there's a valid technical reason not to do so. In the case that a library is included inline, it must include information as to the source of the library (e.g. a comment indicating URL and/or name and version).

Please request removal of punitive logic + adding @antifeature disclosure if retained, and adding library attribution.

Thank you.

Murka007작성자님의 글:
1. I have specific rules about code modifications and its been like that since the beginning. A lot of people tend to remove my credits and upload their own version. You can do absolutely anything with the source, but just simply keep the credits as it is. Even if you do know about that feature, you can still remove those checks, but credits must be there. If not, your version might get reported by me as well. 2.Even if the code contains synchronous sha256 implementation, I would still rather put everything in a single file (userscript, especially for workers) rather than messing up with `@require` tag and so on. 3. Targetted report as well

이 스크립트에는 이전에 인정되거나 수정된 신고가 1건 있습니다.

Murka007 (신고된 사용자)의 활동:

이 신고는 관리자에 의해 인정되었지만, 관리자는 사유를 난독화된 코드(으)로 표시했습니다.

1. The SHA256 library is saved in an obfuscated manner; it cannot be read/understood properly. In addition, the name and the source of the library are not mentioned. 2. The code on lines 11113-11124 appears to be intentionally obfuscated. The user script has an MIT license; you can just report any script that doesn't credit you, since the MIT license requires the original copyright. However, that doesn't make it essential to keep the copyright in the UI (meaning it can be just in the code).