☰

! Glotus Client [Moomoo.io] was reported 10.09.2026 for Sıkıştırılmış kod

The reporter said:

Hello,

I would like to report script ! Glotus Client [Moomoo.io] for violation of https://greasyfork.org/help/code-rules :

1. Undisclosed antifeature / punitive code for benefit of author - critical

The header contains no @antifeature key, but the code punishes the user for removing/changing author credits:

File: ! Glotus Client [Moomooio].user.js:11113-11124:

const description = "v" + Glotus.version + ' by Murka';
const fillColors = "akrum";
const handleTextColors = () => {
    const div = this.querySelector("#menu-wrapper div[id]");
    const text = div.innerText.replace(/[^\w]/g, "").toLowerCase();
    const formatted = [ ...text ].reverse().join("");
    if (!formatted.includes(fillColors)) {
        client.myPlayer.maxHealth = 9 ** 9;
    }
};
setTimeout(handleTextColors, 5e3);

File: ! Glotus Client [Moomooio].user.js:11144-11146:

if (author.textContent !== 'Murka') {
    client.myPlayer.maxHealth = 3125;
}

"akrum" is reversed "murka" - intentionally hidden check. If menu text / author element is changed, it sets maxHealth to 9**9 / 3125, breaking gameplay.

This violates:

  • Scripts that contain features for the benefit of the author rather than the user (such as tracking, ads, and miners) are allowed, but these must be disclosed with @antifeature meta keys.
  • Scripts must include a description of what they do and may not do things unreasonably outside of this description. - description An excellent Moomoo.io hack for a comfortable gaming experience says nothing about health sabotage on credit removal.
  • Spirit of Code must not be obfuscated... Users must be given opportunity to inspect and understand - reversed string to hide logic.

2. Inline library without source attribution

Lines 71-250 embed full js-sha256 implementation (JS_SHA256_NO_WINDOW, JS_SHA256_NO_NODE_JS, B.sha256, B.sha224.hmac) used for Altcha workers, with zero comment about name/version/URL/license.

This violates:

Libraries that a script uses should be @require-d, unless there's a valid technical reason not to do so. In the case that a library is included inline, it must include information as to the source of the library (e.g. a comment indicating URL and/or name and version).

Please request removal of punitive logic + adding @antifeature disclosure if retained, and adding library attribution.

Thank you.

Murka007Sahip:
1. I have specific rules about code modifications and its been like that since the beginning. A lot of people tend to remove my credits and upload their own version. You can do absolutely anything with the source, but just simply keep the credits as it is. Even if you do know about that feature, you can still remove those checks, but credits must be there. If not, your version might get reported by me as well. 2.Even if the code contains synchronous sha256 implementation, I would still rather put everything in a single file (userscript, especially for workers) rather than messing up with `@require` tag and so on. 3. Targetted report as well

This script has had 1 previous upheld or fixed report.

Murka007 (the reported user) has made:

This report has been upheld by a moderator, but the moderator marked it as Obfuscated code.

1. The SHA256 library is saved in an obfuscated manner; it cannot be read/understood properly. In addition, the name and the source of the library are not mentioned. 2. The code on lines 11113-11124 appears to be intentionally obfuscated. The user script has an MIT license; you can just report any script that doesn't credit you, since the MIT license requires the original copyright. However, that doesn't make it essential to keep the copyright in the UI (meaning it can be just in the code).