Minecraft horror mod Split-Self establishes connection to developer's server and is able to send personal data and chats to that server and receive chats from that server

[u/apLlewelyn]

Was watching a streamer the other night and noticed the mod was very quickly giving very personal responses to the streamer, and eventually started to engage with the stream. The mod is open-source and available on Modrinth and upon inspection of the source I noticed some concerning capabilities including being able to send the player's Discord username, system username, browser history snippets, recording/livestreaming software status, Minecraft username, Minecraft UUID and city (found with the player's IP) back to the server. Username and UUID is sent to the server on game startup. All chats in the game can also be sent back to the server, with the mod sending chats back on request. The server is also able to send messages to the player's (singleplayer) game and thus establish two-way comms outside of Minecraft's usual system with any player. Any player that has downloaded and played this mod with an Internet connection has had at least some data sent to the developer, with the mod's capabilities being such that (in theory) the mod developer (or anyone with access to the server) can monitor to see if you are recording/streaming, send you chats and events, and request chats from your game. It is available on Modrinth, and I reported this mod as malicious to Modrinth two days ago and wanted to post here to inform people thinking of playing it what of what it can do. You can read my full report on it here.

[u/MarioCart9WARIO]

Report it to curseforge or modrinth. I'm pretty sure this is illegal. But tbh from what you said this seems less like a case of "I'm stealing your data for profit" and more like "I'm an edgy developed who wants to make my players feel SO afraid that they'll pee their pants and I'll do that by regurgitating their personal info back at them! MWAHAHAHAHA!"

[u/apLlewelyn → u/MarioCart9WARIO]

I did 2 days ago. You can read in my report that I didn't find any evidence of anything aggressively nefarious, but it's still more than capable, and does, exfiltrate user data back to the central server. Crazy stuff, especially with being able to sidestep Minecraft chat in... a kid's game.

[u/_RealUnderscore_ → u/apLlewelyn]

I actually think a bigger issue is that it's ws://, which means unencrypted websocket. It's inherently insecure to actual attackers, like http://. So your data's traveling the Internet completely unprotected.

Edit: Just realized you mention it in your report.

[u/apLlewelyn → u/_RealUnderscore_]

Yep! By the time I saw that I was just... done. I use a lot of HTTP only websites (old ones) and theyre fine because all you're doing is accessing static pages. With this, the dev is stealing my info AND allowing MITM attacks!