Do you have to have your popup do the asking? Theoretically, you could just return false always in the page_onbeforeunload function and let the browse handle the prompting of the user.

A hacker has gained (legitimate) access to a popular JavaScript library and has injected malicious code that steals Bitcoin and Bitcoin Cash funds stored inside BitPay's Copay wallet apps. The ...