Script GrassFX:48 malicious script in Gui plugin pretending to be a roblox script

ya it was a gui one i downloaded it to convert my gui’s to scale had nothing to do with scripting

i had used a gui plugin a year ago was great for converting all your gui’s to scale really fast

The fact that it has several functions used for encoding and decoding, and what @AstroCode suggested as well are instant red flags that this isn’t meant to be there. Also:

image

You can see that in this function it’s requiring z (which I assume would be the decoded module id) and then calling a function named run. This is probably a backdoor and you should remove it from your game asap. Make sure you check for other malicious scripts similar to this one because malicious plugins like to duplicate backdoors and spread them in places you’d never think to look.

Good luck!

Awful take. Plenty of developers push forth great products that are safe and reliable for power-users. Fact is that some programmers are just more well-versed and can create better products than you can, so why not save time and support them as a producer in the process?

2 Likes

i put all my versions back to the 15th to be safe not even trying to track all this mess down

1 Like

I agree with you to an extent. However, I think it should be noted that many beginners would have a hard time checking the authenticity of a plugin, and sometimes don’t even know that malicious or fake plugins exist.

If it weren’t for the people that made these types of plugins solely for the purpose of taking advantage of others we wouldn’t have to be on such high alert.

Personally, I think that plugins are a great feature on the platform and are super useful, but they need to be moderated a lot better. There should either be some sort of UGC-like program that verifies users who create quality plugins and allows them to upload or just tighten security on all plugins by verifying that they aren’t malicious before allowing them to be uploaded.

2 Likes

I dont know, everybody has their own methods, mine is not using plugins. If I want something to be done, do it myself, if I use plugins I become lazy.
Of course theres many plugins perfectly safe, thats why I use RigEdit, and I support it. But I prefer to learn, instead of saving time.

You can scale your gui’s without using any plugin, manually or by script, everything is related with scripting

I could write a long thread about checking plugin authenticity, but I’ll save that for another time. Long story short: every uiDesign plugin on that front page is fake. If you see a plugin that seems interesting, first browse the Community Creations category for it because, more often than not, the developer will have posted information about their plugin there.

Be careful, however, because people are sly. This seems to be the correct plugin as it is by Stelrex, the original creator of the uiDesign plugin:


However, upon clicking on the creator, you’ll be brought to a group page named Stelrex, a fraudulent, malicious group that is posing as his user at face-value.
image

People are smart. You have to be quite careful about the things you’re installing because they’ll more often than not come from a malicious source.
To be safe:

  1. See if the plugin provides a DevForum thread about it; that should provide you the correct plugin link above all, so threading that needle should be your first priority.
  2. Double, triple, and quadruple check the source of a plugin. Ideally, you would cross-reference it with a DevForum thread.
  3. Do not permit any plugins to have permissions to inject scripts, have permission to make Http requests, or any other miscellaneous permissions unless you can verify with 100% certainty that it is coming from an original or credible source.

All in all, I’d uninstall whatever uiDesign plugin you acquired and take the one from here instead: UiDesign plugins. Good luck.

3 Likes

ofc you can but it takes like 2 hours compared to 10 mins

1 Like

Learning to do it faster then. Now those 10 minutes of improvement got you at this problem :confused:
Practice never harm anyone

1 Like

Peashie your just getting on my nerves now, Alvin Blox i consider a credible source he recommends plugins in Youtubre videos. Every single new person that ever comes to attempt to make games is gonna run into this kinda trash that shows up on the plugins… just stop… wasting your time trying blah blah to me

My Favourite PLUGINS in Roblox Studio - Bing video

Relax dude, thats my point of view, and I respect any point of view, learn to relax. Idc if someone recomends it or not, its my point of view. I’ve been respectful towards you. And this is a forum we’re free to say our points… cheesee… ¬¬

2 Likes

This mentality is kind of the opposite of what plugins are intended for. Plugins are meant to make your workflow simpler. Think of it like a framework – why re-invent something that already exists?

I do agree however that it is impossible to trust plugins made by users. It’s been apparent for a few years already that the developer library itself has become bloated with malicious plugins. Very unfortunate situation all around.

1 Like

This is an incredibly inappropriate response to her opinion on not wanting to use plugins. I’ve worked with Peashie before on the DevForums and she seems like a very knowledge individual.

I would really consider being more open to opinions in the future moving forward. :slight_smile:

2 Likes

I agree; however, I think the best approach would be to revise the system to instead moderate plugins that file requests for HTTP calls or script injection.

As of recent, we’ve been provided the means to detect these sorts of things in Studio, so I’m a strong proprietor of the idea that said process should be expedited to the catalog (with a warning about the risks!).

1 Like

I agree. If evil ppl wouldnt exist, this kind of problems wouldnt exist. Thats the only problem. Maybe implement better checks on how Roblox lets ppl to upload plugins.

I know my mentality its the opposite to what plugins are for. Thats why I dont use them. I want to learn, no matter if already exists, I want to learn to do it, thats my way to be. I think anyone can use their own methods, all are useful. Just be cautious using other’s works if we’re not able to understand their systems.

EDIT:

Its ok, and I didnt meant to be rude or something by saying my thoughts, this situation is too bad, and I feel bad that you lost ur work. But, well @HollowMariofan gave u a great solution, now just, back to work. Good luck friend @zuggy81

3 Likes

ya i gotta say im a little upset i had to revert and lose everything i did the last 2 days, and it happened at the worst time when i switched my whole project to team i just thought it was animations errors that i had to re upload so i didnt pay attention

1 Like

It really depends, you just have to find original plugin creators and get it from them. Like data store editor and stuff. This uiDesign Lite, pretends to be another plugin, the creator noticed my report to him too, he seems to know that but can’t do anything

Edit; Some time ago I found a website which contains a bunch of original plugins that you can search. I’ll send it later if i have time.

Sorry to hear. As for the future, just be very, very careful. Any catalog on Roblox is a minefield so you just have to be well-versed when it comes to traversing it.

Cute how they try to hide the require, will be fun to take a look at

x = 2
y = 5
z = 5254573264

I can’t deobf anything so, gonna just leave that there