Is this script Malicious?

Help and Feedback Scripting Support
1

I’m currently working on a new game and, I decided to put in a donation leaderboard. I discovered a “MainModule”. When I opened it I found that they were using “Require” to require this: Board - Roblox

I opened it to find this script inside:

if game.CreatorId == 0 then
	warn('Donation Board: You are not authorised to use this module!')
	script:Destroy()
end

local module = {}

module.LoadAssets = function()
	local boards = game.Workspace:WaitForChild('Boards',5)
	local buttonControl = script:WaitForChild('ButtonControl',5)
	local developerProductHandler = script:WaitForChild('DeveloperProductHandler',5)
	local settingsHandler = script:WaitForChild('SettingsHandler',5)
	
	if boards then
		warn("Donation Board: Authorised - Loading Modules")

		local clone = buttonControl:Clone()
		clone.Parent = game.StarterGui	

		local clone = developerProductHandler:clone()
		clone.Parent = boards
		clone.Disabled = false
		
		local clone = settingsHandler:clone()
		clone.Parent = boards
		clone.Disabled = false
		
		for _,b in pairs(boards:GetChildren()) do
			if b.Name == "Screen" then						
				for _,v in pairs(b:GetChildren()) do
					if v:IsA('SurfaceGui') then
						v:Destroy() 
					end
				end
				
				for _,v in pairs(script.Board:GetChildren()) do
					local clone = v:Clone()
					clone.Parent = b
					
					if clone.Name == "ScoreUpdater" then
						clone.Disabled = false
					end
				end					
			end
		end			
		
		for _,b in pairs(boards:GetChildren()) do
			if b.Name == "Buttons" then
				for _,v in pairs(b:GetChildren()) do
					if v:IsA('SurfaceGui') then
						v:Destroy() 
					end
				end						
				
				for _,v in pairs(script.Buttons:GetChildren()) do
					local clone = v:Clone()
					clone.Parent = b
					
					if clone.Name == "Updater" then
						clone.Disabled = false
					end
				end
			end
		end			

		script:Destroy()
	else
		warn("game.Workspace.Boards - Not Found!")
		script:Destroy()
	end
end
	
module.LoadAssets()
	
return module

This script was created by the “trusted” developer Nitefal.
From what I can see, this script is incredibly suspicious.

The start of the script checks if the Developer is the person playing the game. If the developer is infact the person who is playing the game, it immidiately destroys the script. If the developer is not in the game however, it will proceed to Clone many different things. I’m not an expert scripter though, so that’s why I came here.

2

I think it might be malicious. Maybe its a fake donation board to get robux to its owner

3

For that to work I would need to enable 3rd party sales. Which I do not have enabled

4

On the client the CreatorId is always 0, so this would seemingly destroy the script every time? Otherwise it looks like it’s cloning but it’s doesn’t seem to do much with the info. Definitely something to look for in the other scripts though to see if it’s actually doing anything with the info, like the DeveloperProductHandler. Just my $.02

1 Like