It's hiding your cursor while it's over the site, rendering an <img> of a mouse cursor at its location, and then moving that around a) when you move your real cursor, and b) with random perturbations
Note to the author: the illusion would be even better if you used the user-agent to render a system-accurate mouse cursor ;) (on macOS the real cursor is black and the fake one is white)
You're right, it would make the illusion better. I developed this on Ubuntu where the default cursor is black, and I did consider doing this. Eventually decided to just use the default white cursor from Windows because it has better contrast on the dark color scheme. I guess I could set up 3 different color schemes for 3 different cursors for Mac, Linux, Windows, but it may be a bit too much work. I think most people who notice the cursor is different will just think "oh, this website uses a custom cursor", they won't necessarily realize that it's just an image.
I think you could make these changes, but I think that's if you want to have fun doing it. The diminishing returns are tiny and the gag lands well.
With the Pointer Lock API, you can actually take the user's cursor https://developer.mozilla.org/en-US/docs/Web/API/Pointer_Loc... (but the browser will show a notice).
I've already seen sites that change the cursor's appearance, so I wasn't particularly "shocked" by that (I'm on a Mac).
However, what should improve the illusion would be to not move the cursor outside of the view area.
https://mdn.github.io/dom-examples/pointer-lock/
It's a bit odd to me that it doesn't ask for any kind of permission on Chrome, just that a user click initiates it. It does briefly pop a hint that "<esc>" will release the mouse.
Also, kind of obvious given I use a gtk+3 dark theme and the mouse they use is white.
With the genuine browser security concerns that do exist out there (and the often-exaggerated narrative around the degree of the problem), it's worth being explicit that this is not actually a real one
I had assumed there would simply be Javascript calls for this. — how is it a problem that this be possible? that it can make one click on links that can be activated with Javascript on their own already?
Of course it could move one's cursor outside of it's own rendered page that would be problematic, but this trick cannot simulate that either.
And even if there is no a.p.i., when a website does it via some creative hack then one can assume the hack is most likely to work inside it's own window only.
And finally, how would the average layman no there is no such a.p.i.? even the expert could not be sure it wasn't added yesterday.
I really cannot see why the first response would be to panic and think the website somehow found a way to tell the web browser to make X11 calls to move the cursor, which is quite unlikely; the first response would be that there is an a.p.i. to move the cursor inside of it's own window, which is harmless, and after that that there is a creative hack to simulate it, and again, it's very easy to verify whether the cursor can be moved by the website once it leaves the browser window, and it cannot.
Place button A the user wants to interact with at position (X,Y), place iframe button B at position (X+W,Y), with as little a border as possible with the rest of the page, then offset fake cursor by -W. User will try to mouse over button A, mistakenly mouse over button B, and click it in the time it takes to register that the mouse pointer just jumped from the edge of one button to the edge of the other...
[1] Though I can see the trick below maybe working for some browser's permission request "tooltip" UIs...