A plugin or mod is a program running with your server's full access. A malicious one can read every file (tokens, configs), open a backdoor, or wipe the world.
Safe sources
- Modrinth and SpigotMC through our installer: downloads come straight from the source with checksums.
- CurseForge, Hangar, the author's GitHub releases.
- The author's own website, when the community links to it.
Red flags
- "Cracked" or "leaked" premium plugins. They are the number one carrier of malware; one incident (a poisoned *fractureiser*-style jar) took down hundreds of servers.
- Jars sent in a Discord DM or hosted on a file-sharing site.
- A plugin that asks for your panel password or "needs" your API key.
- A jar much larger or smaller than the official one.
Checking what you have
Ask Kowalski: "list my plugins with their sources". For anything you did not install through the installer, compare the file size and hash with the official release. Delete what you cannot account for and restart.
If you suspect an infection: stop the server, change your passwords, open a ticket and we help you clean it or restore a backup from before the plugin arrived.