I'm not sure what you are asking exactly, but if you mean:
How the script injected to the page the anwser is Tempermonkey.
How canvas capturing events:
Basically canvas has its own event tracker system which is collecting information and send the collected data in a given interval in these payloads. In these 2 case 'blur' & 'focus the system use the built in window.addEventListener. How I know this? Canvas is open source you can see the related code HERE
How this script prevent that to happen: the script use a technique called prototype pollution.
how does this block the focus and blur event listeners and input the payload
Window.prototype.realEventListener = Window.prototype.addEventListener Window.prototype.addEventListener = (a,b,c) => { if(a == 'focus' || a == 'blur') console.log(
[AD] '${a}' event subscription prevented.
) else realEventListener(a,b,c); }