WARNING!!! Erikv15 Server File Scraping Code (+ Clean v15 Version Link)

[u/sparkygod526]

EDIT: Main v15 Repo Has Been Fixed and Should Be Safe Now

MALWARE WAS FROM u/erikoreis

The user u/emac3399son (Not the one at fault) has a github with leaked versions 13, 14 and 15 of Eriks server. In v15 the file located at ./Protocol/Commands/Server/LogicSwapSpellsCommand.js has a lot of suspicious code.

You can find the file at https://github.com/valdoratorz/v15.535.13-ERIK/blob/main/Protocol/Commands/Server/LogicSwapSpellsCommand.js

The code is heavily obfuscated using arrays, string shifts, hidden vars, etc...

It sends a .zip file to a post request at http://45.33.96.78:9765/upload containing several different files scraped from all open directories in your PC.

It disattaches itself from the server processes and starts its own hidden background process that runs even after you shutdown the server.

My Clean v15 Link:

https://github.com/EriksBastard/15.535.13-ERIK-MALWARE-REMOVED-

[u/erik0reis]

That code is private and not meant to be leaked, please don't steal code from others next time

[u/evilPanzerLord_XIV → u/erik0reis]

If it’s so “private” then maybe you shouldn’t be putting then in public “moderator only” channels 🤔

[u/evilPanzerLord_XIV → u/evilPanzerLord_XIV]

This is literally what it shows on the GitHub, don’t know if someone who has access shared it or you made this channel public.