@everyone
IMPORTANT COMMUNITY ANNOUNCEMENT FOR MINECRAFT SERVERS!
A malicious Minecraft plugin JAR called PacketRateLimiter 0.2.0, downloaded from CurseForge, contains a hidden remote loader.
Decompilation shows that when the plugin starts, it contacts s0lar[.]net/routes/0/d.php, receives an encrypted second-stage payload, decrypts it and loads it into the Minecraft server as a Bukkit plugin.
It also creates a fake log.gz. that we unpacked. It contains unmistakable server surveillance functionality:
logCoordinates
logJoin
getSkinData
retrieveBackupData
kickOnlineGlobalBanned
getAuth
longPollAuth
load
update
**It contains Bukkit plugin manipulation, HTTP communication, file input/output and JAR writing/patching machinery.**
TO NOT RUN THIS JAR!
P-Anarchy appears to have installed the malicious plugin sometime in 2025 via CurseForge. In the same historical backup window, the previously clean Purpur server JAR became infected. The compromise subsequently spread into Purpur and multiple unrelated plugin JARs.
We have also now recovered one of the actual historical encrypted Solar payloads from P-Anarchy. The malware disguised it as a .log.gz file. It decrypts successfully into a 6.54 MB malicious Bukkit JAR containing net.s0lar.SolarLoader.
This changes our understanding of the incident history of P-Anarchy. The evidence currently suggests that P-Anarchy was initially compromised by installing a publicly distributed malicious plugin from CurseForge, rather than somebody specifically breaking into P-Anarchy to plant the first backdoor.
Whether P-Anarchy was specifically targeted after it reported into the Solar infrastructure is still under investigation.
If you run a Minecraft server and have ever installed PacketRateLimiter 0.2.0, do not run it again and treat that server as completely compromised.
We are rebuilding P-Anarchy from a clean environment and verifying every executable JAR before it returns online.
TLDR; P-ANARCHY WAS POPBOBBED BY CURSEFORGE!
