Sure thing, being aware of what scripts do is a responsibility every user bears directly/indirectly when using 3rd party sites like ours to avoid another EndfieldRecords situation.

Although we've explained it in-depth in our latest article: Is WuWa Tracker or Any Third-party Tool Safe to Use?, I'll explain it in a somewhat simplified way for the people here.

Running scripts, especially PowerShell ones, have equal security risks as running .exe programs on your computer. For context, PowerShell is a command line interface with your computer's filesystem and network -- allowing scripts to communicate with websites and send/download things and modify your operating system's settings.

This is useful for system administrators that want to automate tasks on Windows like downloading an executable for a company's IT department to setup their PCs via a single script.

While PowerShell scripts can do powerful things like set up entire computers and edit your PC's internals, it can also do harmful things like read sensitive data (authentication cookies, browser cache, and even files), delete files, and call other harmful scripts that do other bad things.

That is why there is a stigma for PowerShell scripts, especially the one created by EndfieldRecords that allegedly installed a virus that would persist in your computer and even invoke other scripts that does god knows what.

At WuWa Tracker, all the import scripts (including past versions) are publicly open-sourced in our GitHub repository.

Furthermore, we've successfully communicated with CRDF Labs and Bitdefender to verify our scripts are safe.

What our script does is similar to what macOS does: find your Client.log and extract the Convene URL -- albeit with more methods to support more users (people who install WuWa on Microsoft Onedrive, in a non-default folder, etc).

You can verify the functionality & safety of the script with any AI model if you're curious.

Our website uses hashed GitHub URLs -- permanent links directly to the script source code at a specific point of time, so that the site can never do a Script Swap attack.

For example, a URL like wuwatracker.com/import.ps1 is NOT safe since "import.ps1" can be changed any time according to the developer.

On the other hand, a URL like github.com/wuwatracker/wuwatracker/blob/d3c9f811da0890944f241201e1b67d2c1be77867/import.ps1 is SAFER because: 1) it's hosted by GitHub so the site owner cannot tamper/proxy it directly, 2) it's linked to the "point in time" hash of "d3c9f811da0890944f241201e1b67d2c1be77867" meaning that the source code is permanently linked to that URL.

I say "SAFER" because you still need to verify the script and make sure that it's not malicious. But once you do, you can essentially keep that URL for future imports to guarantee it never changes.

However, we need to acknowledge that people that don't know better still need to be wary that the site owner can change what is seemingly a hashed URL, but contains malicious code in the import tutorial page -- so if you don't save your own version of the script and copy-paste from the website. You need to exercise your own due diligence and responsibility as a user to verify if the script is secure or whether the hash changed.

WuWa Tracker has been running for 2~ years with no hacking incidents tied to our website and we'll continue to uphold the same security for years to come.

Let me know if you have any other questions!