海角社区免费版-kalami bol nahlásený 27.07.2026 ako neoprávnená kópia skriptu https://www.kittymao.xyz/script/18.

Report Against Script 588329: Copying Another Script, Reusing Its API Credential, and Unrelated Site-Wide Matching

1. Copying and modifying the KittyMao script without providing authorization or a license

The script description explicitly states that it was “modified from another person’s free script,” but it does not identify the original author, source, license, or authorization for republication.

Reported source: https://sleazyfork.org/en/scripts/588329/code
Original KittyMao script page: https://www.kittymao.xyz/script/18
Original KittyMao source: https://file.kittymao.xyz/file/hj.user.js

A line-by-line comparison shows extensive identical code, including:

• Haijiao domain-matching rules;
• interception of /api/topic and /api/attachment requests;
• triple-Base64 data decoding;
• paid-video player and sell-btn element injection;
• removal of preview limits by modifying data-preview;
• video retrieval, response replacement, and notification logic.

After normalizing whitespace, at least 72 of the 118 unique substantive code lines in script 588329 are exact matches with the original script. Describing a script as “free” does not automatically grant permission to copy, modify, and republish it. No license or authorization supporting this republication is provided.

2. Embedding an API credential issued for KittyMao script 18

Script 588329 hard-codes a credential and continues calling KittyMao’s API:

• API: https://kittymao.xyz/api/hj/movieInfo
• Parameter: kthjau
• Decoded credential claims: scriptId: 18, scriptNickname: "hj", and passcodeId: 8048

The credential was issued at 13:13 on July 24, 2026. The first version of script 588329 was published at 13:55 on the same day, approximately 42 minutes later.

Version history: https://sleazyfork.org/en/scripts/588329/versions

This shows that a credential specifically issued for KittyMao script 18 was obtained shortly before publication and then embedded in the copied version. It bypasses the original script’s passcode-claiming process while continuing to use the original service. The reported script’s core video-resolution functionality therefore remains dependent on the original script’s API rather than an independently implemented service.

3. Unrelated site-wide matching

The source declares:

• @include https://*/post/details/*
• @match https://*/post/details*

These rules cause the script to execute on /post/details pages under any domain, even though its APIs, selectors, and functionality are specific to Haijiao. This violates the rule prohibiting @include or @match entries for websites where the script provides no relevant functionality.

4. Abnormal installation growth immediately after publication

The public statistics show:

• July 24: 124 installations and 12 update checks;
• July 25: 1,085 installations and 39 update checks;
• July 26: 892 installations and 53 update checks.

Statistics: https://sleazyfork.org/en/scripts/588329/stats

A newly published copied script with no ratings exceeded one thousand installations on its second day while retaining very few update checks. This provides additional supporting evidence of abnormal exposure.

Script 588329 substantially copies KittyMao script 18, embeds a credential issued for the original script, continues depending on the original author’s service, and uses unrelated site-wide matching. Please remove script 588329.

rootrmrf (nahlásený používateľ) urobil:

• 1 skript
• 5 komentárov

Táto sťažnosť bola moderátorom schválená.