To add on to this, you should never give plugins permissions they do not need. GFlow (for example) shouldn’t need script injection at all since it has no need to insert scripts in the first place.
2 Likes
Omg thank You I deleted all but one plugin (That I acually use) and it went away after I delted form explorer!!!
Thank You @guilherme25sj78 and @WaviestBalloon and @hurzell so much!!!
2 Likes
Lesson learned.
Thank You So Much!!
1 Like
That’s good that it’s no longer there, now I would report the plug-in if it is really adding those scripts in.
Furthermore, may you give me the plugin’s URL so I can install it for myself and take a look at it?
1 Like
No problem. Personally i think deleting them was unnecessary, you only have to disable script injection, that prevents the plugin from making ANY scripts.
1 Like
This was problay the one
The creter made a 2nd version 2 weeks ago aswell.
I literally only use one now.
The other ones are pointless.
Ok, did a quick dig and now I know what is happening!
This one (https://www.roblox.com/library/4517577530/GFlow-UIGradient-editor) is the legitmate add-on, use this one, the other one (https://www.roblox.com/library/7144327111/GFlow-UIGradient-editor) is a group, not a user:
(https://www.roblox.com/groups/11615087/Fabuss254)
The fake add-on also had comments disable, which in it’s self is a bit suspicious.
3 Likes
Can concur, directly after installing things that should not appear started appearing, strange how it bypassed the script injection permission completely. It never even asked
4 Likes
Omg I dug in too I had another plug in this man made by ALreadypro
1 Like
Scroll up and you would see it.
I have never seen that before, incredibly clever. Guess it’s time to make it a habit to check all my plugins
1 Like
Well he copied them and there plugin.
Seems like the person behind this is making groups to fake usernames on add-ons and user-created content, just report the groups/user and hope that ROBLOX does it’s job
Profile of the user:
3 Likes
Seems like the person behind this is making groups to fake usernames on add-ons and user-created content, just report the groups/user and hope that ROBLOX does it’s job
Done. Personally i think Roblox should remove the ability to make group names identical to usernames, that would mostly eliminate this problem.
3 Likes
I’ve made a abuse report! Hopefully, this works.
Sadly, that is most likely hard to moderate automatically, since there is always room for false positives (Compare it like the ROBLOX chat filter) although I have had times where I was able to get my username unfiltered from chat via ROBLOX’s support team.
Have a good day, and remember to be mindful of the danagers of add-ons and their permissions, stay safe! 
8 Likes
The filter is particularly notorious for having horrible aim, it would be nice to see an improvement there 
Have a good day, and remember to be mindful of the danagers of add-ons and their permissions, stay safe!
Right back at you
4 Likes
But what does it accually doo??
1 Like
What do you mean exactly? Do you mean what does the script do?
4 Likes
On Roblox you can use the
require()
function to run code from a modulescript you upload to the website. The modulescript in question allows malicious users to execute code on your game, basically allowing them to join the game and mess with all of it. It wouldn’t affect your game permanently, only that server.
1 Like