Just for the sake of inadequacy of the sorrowful code...

And though I was banned on the /0 instance for a single message, too, with some experience in web-dev I just wanted to clarify regarding the possible immaturity of the sad malicious script authors, sorry...

That attempt seems too reckless and disregards the client optimizations, I believe, and may "choke" the JavaScript engine event-loop of common clients as modern browsers, since Fetch API is asynchronous, and not to mention net::ERR_INSUFFICIENT_RESOURCES that may also cause lagging in the client.

A few milliseconds timeout, or more adequate batching/chunks seems required. For example:

async function fetchChunks(urls, chunkSize = 10) {
  for (let i = 0; i < urls.length; i += chunkSize) {
    const chunk = urls.slice(i, i + chunkSize);

    try {
        await Promise.all(chunk.map(url => fetch(url)));
    } finally {
        await new Promise(r => setTimeout(r, 50));
    }
  }
}

const urls = [];

for (let i = 0; i < 50; i += 1) {
    const random = ...;

    urls.push(`https://test.test/$%7Brandom%7D`);
}

fetchChunks(urls);

That would at least make it more adequate in the scope of User clients with less but still loading them awfully and disrespectfully... which is sorrowful indeed...

In other words, their current "malicious" code is just...wrong...
Regardless, such actions may tarnish someone's history much to the point their self-confidence may not recover shortly and require a great amount of time to believe in yourself hopefully again... Therefore, let's hope the people behind it will reconsider their actions as soon as possible... and won't dig their own beliefs and love too deep to search for later...