It's injecting an XSS Hunter script, from https://xsshunter.com/