DGuard
Start for free

Malicious plugins and backdoors: keeping your server clean

A plugin gets full access not just to the server but to the whole machine it runs on — Paper's docs say so directly. So a backdoored plugin isn't "a few cheats"; it's a stranger with owner rights. Here's where such plugins come from, how to avoid installing one, how to check your server, and what to do if it's already infected.

The DGuard team7 min read

In short: download plugins only from Hangar, Modrinth, SpigotMC, BukkitDev or the author's own GitHub releases, and never install "free" leaks of paid plugins. Check who has OP and what's in plugins/. If the server is infected, treat the whole machine as compromised: stop the server, change every password and key from another device, and rebuild from clean files.

Why a plugin is dangerous

A plugin is Java code the server runs. Nothing restricts it: it can give OP to any name, run console commands, read configs with database passwords, download and launch another program. Paper's docs warn about this in a box of its own: plugins get full and unrestricted access to the server and the machine, so they must only be installed from sources you fully trust.

Where malicious plugins come from

SourceThe risk
Leaks of paid pluginsA jar from an unknown site that someone rebuilt. You can't check what was added
Unknown sites and groupsNo author history and no moderation; the file can be swapped at any time
Files "from a friend" on DiscordThe same unknown jar, just with trust in the sender
A hijacked author accountAn infected version is published under the real name in an official catalog
An infected developer machineThe malware writes itself into jars that are then published as a normal update
The last two are what happened with fractureiser

A real case: fractureiser

In 2023 the fractureiser malware was found on CurseForge and dev.bukkit.org. According to the team that investigated it, the author uploaded several innocent-looking mods and plugins. A well-known modpack developer downloaded one of them, the malware infected files on their computer — and an infected copy of a working project went up to CurseForge as a normal file. That's how copies of several popular plugins and mods got infected.

  • It targeted Windows and Linux and came in several stages: the infected jar downloaded and ran the next one.
  • The last stage tried to infect every jar file on the disk, steal browser cookies and logins, Discord, Microsoft and Minecraft credentials, and swap crypto wallet addresses in the clipboard.
  • The investigation team advised treating any download from CurseForge or BukkitDev made between February and June 2023 as potentially malicious.
  • On Linux the infection showed up as ~/.config/.data/lib.jar and a systemd-utility.service service.

The uncomfortable takeaway: an official catalog lowers the risk but doesn't remove it. So besides choosing the source you need checks and a plan for when an infection happens.

Where to download plugins

  • Hangar — PaperMC's plugin repository; Paper's docs call it the best place to find plugins.
  • Modrinth and BukkitDev — Paper names them too; SpigotMC — the Spigot community's plugin catalog.
  • GitHub — many authors publish builds as releases. Take the release from the author's repository that the plugin page links to, not from forks.
  • A paid plugin — only where the author sells it. If it's "free" on another site, it's a leak.

How to check your server

  1. 1

    Compare the plugin list

    plugins in the console and the contents of plugins/. You should recognise every jar and remember where you got it.

  2. 2

    Check OP

    Open ops.json: only the owner should be there. An extra operator is the first sign of a backdoor — more in OP and the whitelist.

  3. 3

    Check permissions

    /lp log recent in LuckPerms shows who changed permissions and when. A random player with * is an alarm.

  4. 4

    Read the log

    In logs/latest.log, look for commands nobody on your team typed and logins from unfamiliar names with rights.

  5. 5

    Check the machine

    Unknown processes, systemd services and cron jobs on the VPS. If the server runs in Docker, check the host too.

For fractureiser the investigation team pointed to jar scanners, for example Overwolf's. But a scanner looks for known malware and may miss a new backdoor — so the main defence stays the same: a known source.

If the server is infected

  1. 1

    Stop the server

    And take it off the network if you can. Treat the whole machine as compromised, not one folder.

  2. 2

    Change passwords from another device

    Hosting, panel, SSH, email, Discord, the Microsoft account, database and RCON passwords, the proxy's forwarding.secret. Turn on two-factor sign-in wherever it exists.

  3. 3

    Reissue keys

    The DGuard license key is in plugins/DGuard/config.yml: issue a new key in the panel — the old one stops working right away.

  4. 4

    Rebuild from scratch

    The fractureiser team suggests simply reinstalling the system as the safe default. Take worlds and configs from a backup made before the infection, and download every jar again from official sources — jar copies in the backup may be infected too.

  5. 5

    Check the world

    Look in CoreProtect for what the fake operators did, and roll it back.

An anticheat from a trusted source

An anticheat sits on the server with the same rights as any plugin, so it deserves the strictest standard. DGuard — the best anticheat for a modern Minecraft server — is downloaded only from your panel on DGuard's site and updates itself: a new version is installed only after its signature is verified, and if even one byte of the downloaded file has changed, the signature won't match and the file is deleted. A "leaked" DGuard won't run without a key from the panel — and there's no telling what was added to it.

Ready-made DGuard settings from the config marketplace are config.yml files, not code: the DGuard team checks every version before it's published, and keys, passwords, tokens, hosts and IPs are stripped from the file automatically.

FAQ

Can a plugin hack a Minecraft server?

Yes. A plugin gets full access to the server and the machine: it can grant OP, run console commands, read passwords from configs and launch another program. That's why Paper advises installing plugins only from sources you fully trust.

Is it safe to download leaked paid plugins?

No. A leak is a jar from an unknown site that someone rebuilt, and you can't check what was added. Buy a paid plugin where its author sells it.

How can I tell there's a backdoor on my server?

Extra operators in ops.json, random players with * permissions, commands in the log nobody typed, unfamiliar jars in plugins/, unknown processes and services on the machine. Check all of these and compare the plugin list with what you installed.

What do I do if a plugin turns out to be malicious?

Stop the server, treat the whole machine as compromised, change every password and key from another device, reinstall the system, restore worlds and configs from a backup made before the infection, and download plugins again from official sources.

Sources

Read next

All sections
Server protection9 min readMinecraft server security: the full checklistThe best protection isn't one plugin but several layers: each closes its own hole, and none replaces the others. The anticheat catches cheaters in game, the firewall hides service ports, permissions and two-factor sign-in guard access, and backups and logs save you when something still gets through. Below is a 12-point checklist and a walk through each point.ReadPlugins8 min readHow to install a plugin on a Minecraft serverDownload the .jar from the official page, put it into plugins/ and restart the server — not /reload. Below: how to check compatibility, what to do about dependencies and why a plugin won't load.ReadGetting started8 min readMinecraft server backups: what, how and how oftenA server backup means the worlds, the plugins folder with its configs and data, the server's settings files and your plugins' databases. Automate it, keep at least one copy off the machine, and check now and then that you can actually restore from it.Read

Run the best anticheat for modern Minecraft

DGuard catches all 47 kinds of cheats in our comparison — the closest rival, Intave, has 27. Full protection on every plan, free up to 30 players online.

Protect your server for freeLook inside the panel