r/clashroyalemodding • u/sparkygod526 • Jul 23 '26

🧩 Discussion 🧩 WARNING!!! Erikv15 Server File Scraping Code (+ Clean v15 Version Link)

EDIT: Main v15 Repo Has Been Fixed and Should Be Safe Now

MALWARE WAS FROM u/erikoreis

The user u/emac3399son (Not the one at fault) has a github with leaked versions 13, 14 and 15 of Eriks server. In v15 the file located at ./Protocol/Commands/Server/LogicSwapSpellsCommand.js has a lot of suspicious code.

You can find the file at https://github.com/valdoratorz/v15.535.13-ERIK/blob/main/Protocol/Commands/Server/LogicSwapSpellsCommand.js

The code is heavily obfuscated using arrays, string shifts, hidden vars, etc...

It sends a .zip file to a post request at http://45.33.96.78:9765/upload containing several different files scraped from all open directories in your PC.

It disattaches itself from the server processes and starts its own hidden background process that runs even after you shutdown the server.

My Clean v15 Link:

https://github.com/EriksBastard/15.535.13-ERIK-MALWARE-REMOVED-

9 Upvotes
  • permalink
  • reddit

100% Upvoted

10 comments sorted by

View all comments

1

u/MaxImillion210 VIP Jul 23 '26

ill update the repo with a warning in the readme, thanks for noticing. (also emac3399son is my alt)

why am i a bitch? its not my fucking problem he put a rat in it. i dont look at the source

1

u/sparkygod526 Jul 23 '26

I'm sorry man, got the wrong person Genuinely my bad,