I don't think this simple app would have bad intentions, but your workaround isn't bulletproof either. The fact that the user has opened Dev Tools is detectable

I don't think this simple app would have bad intentions, but your workaround isn't bulletproof either. The fact that the user has opened Dev Tools is detectable (I think the console object becomes != null?), so if the author has bad intentions, he can just unload the bad stuff when he detects that Dev Tools has been opened. I've seen some sites unload the page and set up a breakpoint when Dev Tools is opened, so you can't even browse the source in it. I guess the trick would be to download the page's sources using wget, but if they used some obfuscation it becomes more painful to figure out what files need to be downloaded...