by Stabber » Tue Jan 13, 2015 8:47 pm
It isn't a hack. The server sends you the inventory of all players on your friends lists (probably so that it can show profiles of your friends wearing their equipment). This information is sent out unencrypted in plaintext, so it is very easy to read in a modern browser by checking incoming connections. No javascript knowledge required.