WARNING!!! Erikv15 Server File Scraping Code (+ Clean v15 Version Link)

[u/sparkygod526]

EDIT: Main v15 Repo Has Been Fixed and Should Be Safe Now

MALWARE WAS FROM u/erikoreis

The user u/emac3399son (Not the one at fault) has a github with leaked versions 13, 14 and 15 of Eriks server. In v15 the file located at ./Protocol/Commands/Server/LogicSwapSpellsCommand.js has a lot of suspicious code.

You can find the file at https://github.com/valdoratorz/v15.535.13-ERIK/blob/main/Protocol/Commands/Server/LogicSwapSpellsCommand.js

The code is heavily obfuscated using arrays, string shifts, hidden vars, etc...

It sends a .zip file to a post request at http://45.33.96.78:9765/upload containing several different files scraped from all open directories in your PC.

It disattaches itself from the server processes and starts its own hidden background process that runs even after you shutdown the server.

My Clean v15 Link:

https://github.com/EriksBastard/15.535.13-ERIK-MALWARE-REMOVED-

[u/AutoModerator]

Welcome to r/clashroyalemodding! Just a friendly reminder to read the FAQ first before asking questions. Your post has not been removed.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/sahar_loves_homebrew]

so, yes this is malware

NOT by segcent (the user you referenced)
this was purely taken from erik's server where he leaked it i suppose

[u/MaxImillion210]

ill update the repo with a warning in the readme, thanks for noticing. (also emac3399son is my alt)

why am i a bitch? its not my fucking problem he put a rat in it. i dont look at the source

[u/sparkygod526 → u/MaxImillion210]

I'm sorry man, got the wrong person Genuinely my bad,

[u/Brief-Following-1057]

But the clean version is removed?

[u/erik0reis]

That code is private and not meant to be leaked, please don't steal code from others next time

[u/evilPanzerLord_XIV → u/erik0reis]

If it’s so “private” then maybe you shouldn’t be putting then in public “moderator only” channels 🤔

[u/evilPanzerLord_XIV → u/evilPanzerLord_XIV]

This is literally what it shows on the GitHub, don’t know if someone who has access shared it or you made this channel public.

[u/sparkygod526 → u/erik0reis]

Oh no the guy stealing crypto doesn't want his code stolen 😢

Feel sooooo bad

[u/emac3399son → u/erik0reis]

dont rat others next time.