You might be right, I think I switched it on when I first installed the browser.
It will give you the icon showing an S with red strikethrough, you have to manually check which scripts are allowed. The default is ALLOW ALL. Dangerous and irresponsible. Tor project is compromised.
But it's the only way to access the dark web. I think it's safe combined with a VPN, but I'm not a cybersecurity expert. I would want a technical explanation from an expert on exactly why/how it may be compromised.
You can use Tor network without Tor browser. Use an open source script blocking browser.
(post is archived)