Hi Skymon! 🙂 Yes — let's analyse it as code, not as a personal conflict. For your Wikimapia work, the important questions are: what does the script actually do, does it contain code that targets particular users, and what risks would it create for your editing?
One important distinction at the outset: the alarming report you pasted makes several serious claims about the author and their intentions. Those claims need to be checked against the actual source code. A user ID appearing in a script, for example, is not by itself proof of sabotage.
## 1. What the published page tells us
The [Wikimapia NG1 Script Export page on Greasy Fork]( describes a userscript for Wikimapia's older interface. Its published information says:
— Version: 5.5.5.2
— Last updated: 3 March 2026
— Author account: `wng-script`
— Installation: through a userscript manager such as Violentmonkey
— Purpose: enhance the older Wikimapia interface, including imagery, navigation, editing shortcuts and additional reference tools.
[image](
Greasy Fork
The page also says that much of the functionality is implemented in the old interface, while the newer interface has more limited functionality. It documents keyboard shortcuts, object editing and map imagery features.
[image](
Greasy Fork
This is a browser userscript, so its permissions and behaviour depend on the actual code and the websites it can access. That makes inspecting the source much more useful than judging it from its description or its author's reputation.
## 2. The important finding: deliberately obscured code
The source contains a particularly important block around lines 195–200. It uses several layers of encoding, dynamically evaluates the decoded JavaScript, and references `parent.uid`, which appears to be the current user's ID in the Wikimapia interface.
[image](
исходный код
Here is why that deserves attention:
Confirmed in the published source
The script contains obfuscated code using `eval`, Base64-like encoded strings, and logic that references the current user's ID
A significant concern
Other obfuscated code near the end of the script conditionally removes the message and comment forms from the page. The encoded condition needs decoding to establish exactly which users are affected and under what circumstances.
[image](
исходный код
Not yet established
I have not independently verified that user ID `246015` (skymon) is in a restriction list, nor established the author's intent. A search for the literal number in the published source did not find it; an encoded ID could, of course, evade a plain-text search.
[image](
исходный код
+1
Obfuscation alone doesn't prove malicious intent. Developers sometimes obscure code for other reasons. But hiding user-specific conditions inside dynamically evaluated code makes independent auditing substantially harder, and conditionally removing interface elements could deliberately restrict functionality if the conditions target selected accounts.
## 3. What the script does in ordinary operation
The visible source also contains substantial ordinary functionality:
— Adds navigation and keyboard shortcuts between old and new Wikimapia.
— Modifies map behaviour and adds Google Street View support.
— Changes the interface for object editing and browsing user profiles.
— Uses browser storage for script preferences.
— Makes XMLHttpRequests to Wikimapia endpoints for functions such as loading objects and messages.
[image](
исходный код
+2
So I would not describe the entire script as malware based on the evidence examined so far. Nor have I established that it steals credentials or sends private data to an external server.
The narrower and more defensible concern is the combination of obfuscated executable code, account-dependent logic and possible suppression of interface elements.
## 4. What I recommend for your Wikimapia account
Given your mapping work, I would not install this particular version until the obfuscated sections have been decoded and audited. That is a precaution based on the source, not a conclusion about the author's character.
You can also inspect the source without installing it:
[Read the complete published source code](
The next step that would settle the main question is to decode the block around lines 195–200 and the conditional code around line 3364, then trace the exact account IDs and the conditions that trigger the removal of editing, messaging or comment elements.
My verdict so far: there is concrete reason for caution, but the specific allegation that Skymon was deliberately targeted remains unverified. I would rather establish that from the decoded code than ask you to rely on anyone's accusation — including mine.