No Padding Module

    TypeScript icon, indicating that this package has built-in type declarations

    2.1.2 • Public • Published


    Linting Run a security audit Coverage Run the testsuite

    Dependency Status devDependency Status Test Coverage Code Climate Known Vulnerabilities

    Commitizen friendly Dependabot Status License npm

    A Koa.js powered Node.js backend to blacklist leaked Spigot Premium plugins


    I'm sad that such a project is existing.
    Since 2011 I'm providing the community with a lot of free CraftBukkit plugins. Over one and a half million downloads in total. That is a huge number. Nevertheless, the community is in some points an unkind one. It does not matter how much spare time you spent working on the new version, the update was never fast enough. And complaining is always easier than saying 'thank you!'.

    With the premium plugin solution, Spigot offers the developers a way to the get something back for their work. And in general a lot cheaper than hiring a private plugin developer. When you see your plugin only one week after the initial release on sites that offer leaked plugins, it's frustrating.

    That's why I decided to make my own validation service - to blacklist the leaker is often a lot faster than sending DMCA requests to One-Click-Hosters (OCH).


    The Spigot built in piracy protection is known and easy to remove. There is a way to receive the user id of the buyer in your code. Please contact me on SpigotMC, I'd like to make the method not total publicly accessible (although it is when you dig enough).

    Once you retrieved the user id you can make a POST request the URL where you service runs. In the body, include the following information:


    (userId works, too)

    An example Java implementation can be found in docs/.

    The service is only accepting POST, no GET. You receive a JSON with either blacklisted true or false:

        "blacklisted": true


    Ensure that your server you wish to run the piracy backend with is running at least Node.js v12 LTS

    Normal Installation

    $ npm install -g spigot-anti-piracy-backend

    (Optionally without the global flag)

    Development Installation

    $ git clone
    $ cd spigot-anti-piracy-backend
    $ npm install
    $ npm run watch


    You need to manually maintain a blacklisted users file. I'd recommend a simple text file, with one blacklisted user id per line.

    Just use

    $ npm run start

    Configuration via environment variables

    Environment Variable Default Description
    PORT 3000 Port to run the app on
    BLACKLISTED_USERS_FILE ./banned_users.txt Blacklist file
    LOG_FILE ./request.log Log file for requests
    PROXY false Tells Koa to run on proxy mode, for support for X-Forwarded Headers
    JSON_LOG true Logs to the file in a JSON format, disable for human readable output

    It's up to you, if you would like to spin the service up with e.g. a linux start script.
    For example, below is a systemd script which runs the script as a non-privileged user.

    Description=Spigot Anti-Piracy Backend Server
    # Assuming a global installation


    You can watch the app.ts for file changes via the task

    $ npm run watch

    It uses Nodemon to watch for file changes and re-starts the server if any are found.

    Test are run with Mocha via

    $ npm run test

    The code is linted using TSLint.
    Keep the warnings to zero. 😄

    Please make sure they all pass and add new ones when you develop new stuff! 😄

    Please follow the commitizen style when making new commits!


    Since this is a blacklist solution, a planned future is to validate the supplied user id against the buyers of the premium plugin. Only when it's on the list, the plugin is allowed to start (as long, as the user is not blacklisted).

    The following document query can be used to retrieve an array of all user ids who bought the plugin:

    let buyers = Array.from(
    buyers.forEach((elem, index, arr) => {
        arr[index] = parseInt(
                .replace(/\/members\/[-_a-zA-Z0-9]+\./, '')
                .replace('/', '')

    Built by (c) Tim Brust and contributors. Released under the MIT license.


    npm i spigot-anti-piracy-backend

    DownloadsWeekly Downloads






    Unpacked Size

    43.4 kB

    Total Files


    Last publish


    • timbru31