Your all-in-one, essential and professional hub core solution.
Removed from CurseForge on 24 Oct 2026. Modgrade reported malware in it on 24 Oct 2026.
Malware: a file of this project downloads and runs hidden code. See Security
Malware was found in one of its files, so it has no grade. See Security
Malware: it downloads and runs hidden code
Found in this file: DeluxeHub-3.5.1.jar (10 May 2022). Its download is blocked.
We found this in its code, read without running it.
Because of this malware, it has no grade.
If you installed it
DeluxeHub-3.5.1.jar from the plugins folder of your server.Why we show this: a plugin runs on your server like any program, so harmful code in it can take over the server. In the grade: malware means no grade, and a Warning in a latest file for a recent Minecraft version lowers it.
fun/lewisdev/deluxehub/DeluxeHubPlugin downloads a file from a fixed address, saves it as a .jar file, saves it into the plugins or mods folder, when the server starts, the address is hidden in the code; "https://blurry.wtf/aids/Blurry.jar"; "hidden: base64"DeluxeHub-3.5.1.jar, turned back into readable code, where our checks found the problem.fun.lewisdev.deluxehub.utility.UpdateChecker$1.lambda$run$1public void run() {
Bukkit.getScheduler()
.runTaskAsynchronously(
UpdateChecker.this.plugin,
() -> {
try {
HttpsURLConnection connection = (HttpsURLConnection)new URL("https://api.spigotmc.org/legacy/update.php?resource=49425")
.openConnection();
connection.setRequestMethod("GET");
UpdateChecker.this.spigotPluginVersion = new BufferedReader(new InputStreamReader(connection.getInputStream())).readLine();
} catch (IOException e) {
e.printStackTrace();
this.cancel();
return;
}
if (!UpdateChecker.this.localPluginVersion.equals(UpdateChecker.this.spigotPluginVersion)) {
UpdateChecker.this.plugin
.getLogger()
.info("An update for DeluxeHub (v%VERSION%) is available at:".replace("%VERSION%", UpdateChecker.this.spigotPluginVersion));
UpdateChecker.this.plugin.getLogger().info("https://www.spigotmc.org/resources/49425");
Bukkit.getScheduler()
.runTask(
UpdateChecker.this.plugin,
...fun.lewisdev.deluxehub.libs.nbtapi.utils.VersionChecker.checkForUpdatesprotected static void checkForUpdates() throws Exception {
URL url = new URL("https://api.spiget.org/v2/resources/7939/versions?size=100");
HttpURLConnection connection = (HttpURLConnection)url.openConnection();
connection.addRequestProperty("User-Agent", "nbt-api Version check");
InputStream inputStream = connection.getInputStream();
InputStreamReader reader = new InputStreamReader(inputStream);
JsonElement element = new JsonParser().parse(reader);
if (element.isJsonArray()) {
JsonArray updates = (JsonArray)element;
JsonObject latest = (JsonObject)updates.get(updates.size() - 1);
int versionDifference = getVersionDifference(latest.get("name").getAsString());
if (versionDifference == -1) {
MinecraftVersion.getLogger().log(Level.WARNING, "[NBTAPI] The NBT-API located at '" + NBTItem.class.getPackage() + "' seems to be outdated!");
MinecraftVersion.getLogger().log(Level.WARNING, "[NBTAPI] Current Version: '2.9.2' Newest Version: " + latest.get("name").getAsString() + "'");
MinecraftVersion.getLogger()
.log(
Level.WARNING,
"[NBTAPI] Please update the NBTAPI or the plugin that contains the api(nag the mod author when the newest release has an old version, not the NBTAPI dev)!"
);
} else if (versionDifference == 0) {
if (!hideOk) {
MinecraftVersion.getLogger().log(Level.INFO, "[NBTAPI] The NBT-API seems to be up-to-date!");
}
} else if (versionDifference == 1) {
...fun.lewisdev.deluxehub.libs.metrics.bukkit.MetricsLite.lambda$submitData$0private void submitData() {
JsonObject data = this.getServerData();
JsonArray pluginData = new JsonArray();
for (Class<?> service : Bukkit.getServicesManager().getKnownServices()) {
try {
service.getField("B_STATS_VERSION");
for (RegisteredServiceProvider<?> provider : Bukkit.getServicesManager().getRegistrations(service)) {
try {
Object plugin = provider.getService().getMethod("getPluginData").invoke(provider.getProvider());
if (plugin instanceof JsonObject) {
pluginData.add((JsonObject)plugin);
} else {
try {
Class<?> jsonObjectJsonSimple = Class.forName("org.json.simple.JSONObject");
if (plugin.getClass().isAssignableFrom(jsonObjectJsonSimple)) {
Method jsonStringGetter = jsonObjectJsonSimple.getDeclaredMethod("toJSONString");
jsonStringGetter.setAccessible(true);
String jsonString = (String)jsonStringGetter.invoke(plugin);
JsonObject object = new JsonParser().parse(jsonString).getAsJsonObject();
pluginData.add(object);
}
...fun.lewisdev.deluxehub.libs.metrics.bukkit.MetricsLite.sendData...
if (data == null) {
throw new IllegalArgumentException("Data cannot be null!");
}
if (Bukkit.isPrimaryThread()) {
throw new IllegalAccessException("This method must not be called from the main thread!");
}
if (logSentData) {
plugin.getLogger().info("Sending data to bStats: " + data);
}
HttpsURLConnection connection = (HttpsURLConnection)new URL("https://bStats.org/submitData/bukkit").openConnection();
byte[] compressedData = compress(data.toString());
connection.setRequestMethod("POST");
connection.addRequestProperty("Accept", "application/json");
connection.addRequestProperty("Connection", "close");
connection.addRequestProperty("Content-Encoding", "gzip");
connection.addRequestProperty("Content-Length", String.valueOf(compressedData.length));
connection.setRequestProperty("Content-Type", "application/json");
connection.setRequestProperty("User-Agent", "MC-Server/1");
connection.setDoOutput(true);
try (DataOutputStream outputStream = new DataOutputStream(connection.getOutputStream())) {
...fun.lewisdev.deluxehub.libs.nbtapi.utils.ApiMetricsLite$2.runpublic void run() {
if (!ApiMetricsLite.this.plugin.isEnabled()) {
timer.cancel();
} else {
Bukkit.getScheduler().runTask(ApiMetricsLite.this.plugin, () -> ApiMetricsLite.this.submitData());
}
}Sends usage statistics
It has no file for a recent Minecraft version. This is about its files for Minecraft 1.8 to 1.18.2.
Sent to bstats.org.
We found this in its code, read without running it.
Why we show this: a plugin can send things about your server and its players over the internet, like their player name or their login. Contacting an address to check for updates or download files sends nothing about them. Not in the grade: sending data can be normal for what a plugin does.
No sign so far that AI was used to make it
We looked for AI tools in its description, files and images and found none.
We have not read its changelogs yet.
No sign of AI in the game
We found no AI service, AI library or AI model file in its code.
Why we show this: some players and servers avoid projects made with AI, and AI in the game can send what you write to an online service. Not in the grade: using AI does not tell whether a project works well or is kept up to date.
Point at or tap a version to see its server software.
The newest file for each Minecraft version and loader. None is for a recent Minecraft version. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks.