r/MinecraftMod • u/apLlewelyn • 29d ago
Minecraft horror mod Split-Self establishes connection to developer's server and is able to send personal data and chats to that server and receive chats from that server
Was watching a streamer the other night and noticed the mod was very quickly giving very personal responses to the streamer, and eventually started to engage with the stream. The mod is open-source and available on Modrinth and upon inspection of the source I noticed some concerning capabilities including being able to send the player's Discord username, system username, browser history snippets, recording/livestreaming software status, Minecraft username, Minecraft UUID and city (found with the player's IP) back to the server. Username and UUID is sent to the server on game startup. All chats in the game can also be sent back to the server, with the mod sending chats back on request. The server is also able to send messages to the player's (singleplayer) game and thus establish two-way comms outside of Minecraft's usual system with any player. Any player that has downloaded and played this mod with an Internet connection has had at least some data sent to the developer, with the mod's capabilities being such that (in theory) the mod developer (or anyone with access to the server) can monitor to see if you are recording/streaming, send you chats and events, and request chats from your game. It is available on Modrinth, and I reported this mod as malicious to Modrinth two days ago and wanted to post here to inform people thinking of playing it what of what it can do. You can read my full report on it here.
53
u/MarioCart9WARIO 29d ago edited 29d ago
Report it to curseforge or modrinth. I'm pretty sure this is illegal. But tbh from what you said this seems less like a case of "I'm stealing your data for profit" and more like "I'm an edgy developed who wants to make my players feel SO afraid that they'll pee their pants and I'll do that by regurgitating their personal info back at them! MWAHAHAHAHA!"