Add-on Removal from Malicious User

ZOS_Kevin · November 5

Hi Everyone,

For those who use and create add-ons for ESO, we have an update regarding harmful add-ons created by an add-on creator. We recently took disciplinary action against an add-on creator due to several Terms of Service violations. Specifically, add-ons that included malicious content and the related disruption impacting many upstanding ESO add-on creators. These add-ons have been removed, and the ESO account has been banned. We have added a list below to highlight the ones we took action against.

Market Tracker- Data Loader
Writ Cost Calculator- Know the cost before you craft
Back To Keyboard- Prevents AFK and Inactivity Disconnect
Market Tracker- Guild Trader Pricing Assistant
Data Extractor
Fast Warp Optimizer – Unlock Every Wayshrine for Zero Gold
LibText

Some of these add-ons included malicious content that could negatively impact players. This directly impacted those who had them installed and indirectly impacted players who did not have them installed. Most notable of these add-ons being Market Tracker and LibText. As a part of the resolution process, if you had any of these add-ons active, they have been removed and are no longer usable on your account. These add-ons are also no longer available to add to your account.

Normally, we do not disclose user violations. However, we feel it’s important to highlight why we took action in this case. Additionally, for those who used add-ons from this author, you should know how these add-ons may have impacted your account.

The violations include:

Malicious content in add-ons: The usage of malicious content in an add-on could cause issues for potential add-on users. For example, having a hidden blacklist applied to the add-on.
Usage of a hidden blacklist within the add-on: As an example of malicious content, having a hidden blacklist could cause issues for other players. For example, players added to this blacklist would not show up in certain public contexts for anyone who had the add-on installed, like appearing on Guild Traders.
Failure to publicly disclose all elements of the add-on to all potential users.
Repurposing other creators’ add-ons and their work, claiming them as their own and reposting them.

As noted before, these add-ons should no longer be an issue. If you see any add-ons that you suspect could violate the ESO Terms of Service, please make sure to file a support ticket with us and report the add-on.

We want to end with a thank you to our add-on creators who raised this issue with us and were patient as we worked toward a resolution.

spartaxoxo · November 5

This is great news! I am glad that such decisive action was taken. Add-on creators work hard and deserve respect for their efforts. I'm glad that ZOS has come down so effectively against malicious features and theft.

Also, I'm very glad that hidden blacklists are considered malicious code. It's so unacceptable.

Konstanz · November 5

Letter to the Community

Hello everyone,

As a long-time officer in TSC, I’d like to provide some background and clarity regarding a situation that has affected our guild and parts of the trading community.

Some time ago, when TSC was exploring the idea of developing a mobile app to support traders on Xbox NA, we collaborated with a community member who had coding experience. To make this possible, SavageTSC shared her hand-collected sales data—at that time, the only method available for gathering such information from participating guilds.

Afterward, the developer created his own app for the Play Store and Apple Store using data originally sourced from TSC. Unfortunately, proper credit or collaboration terms were not established, which led to a dispute over the app’s data usage. A DMCA takedown request and subsequent counterclaim followed, during which personal information was disclosed through standard legal procedures.

Following that, communications between the parties became tense. Savage experienced significant stress related to the situation, including issues involving website data use, bandwidth strain, and concerns about personal boundaries. Despite these challenges, she continued to maintain and share valuable trading data for the console community.

More recently, guild sales across TSC have declined sharply, affecting our trader placement and revenue. Many long-standing members, including myself, have noticed an impact on both guild and personal sales. These developments have influenced the broader console trading community, especially among guilds contributing data and supporting shared pricing tools.

Our hope moving forward is to return our focus to what has always defined TSC: supporting fair, transparent, and community-driven trading on console. By working together constructively, we can continue to strengthen the marketplace, learn from the past, and rebuild with integrity.

Thank you to everyone who continues to stand by TSC and contribute to the guild’s success and the health of the wider trading network.

Yours in Service,
MissKonstanz
~The Chaos Gremlin
Officer, Tamriel Savings Co.
Xbox NA/PC NA

Dolgubon · November 5

It's sad that this happened in the first place, but thank you to @ZOS_DanBatson and the rest of zos for taking quick action.

Mattymoo92 · November 5

Konstanz wrote: »

Letter to the Community

Hello everyone,

As a long-time officer in TSC, I’d like to provide some background and clarity regarding a situation that has affected our guild and parts of the trading community.

Some time ago, when TSC was exploring the idea of developing a mobile app to support traders on Xbox NA, we collaborated with a community member who had coding experience. To make this possible, SavageTSC shared her hand-collected sales data—at that time, the only method available for gathering such information from participating guilds.

Afterward, the developer created his own app for the Play Store and Apple Store using data originally sourced from TSC. Unfortunately, proper credit or collaboration terms were not established, which led to a dispute over the app’s data usage. A DMCA takedown request and subsequent counterclaim followed, during which personal information was disclosed through standard legal procedures.

Following that, communications between the parties became tense. Savage experienced significant stress related to the situation, including issues involving website data use, bandwidth strain, and concerns about personal boundaries. Despite these challenges, she continued to maintain and share valuable trading data for the console community.

More recently, guild sales across TSC have declined sharply, affecting our trader placement and revenue. Many long-standing members, including myself, have noticed an impact on both guild and personal sales. These developments have influenced the broader console trading community, especially among guilds contributing data and supporting shared pricing tools.

Our hope moving forward is to return our focus to what has always defined TSC: supporting fair, transparent, and community-driven trading on console. By working together constructively, we can continue to strengthen the marketplace, learn from the past, and rebuild with integrity.

Thank you to everyone who continues to stand by TSC and contribute to the guild’s success and the health of the wider trading network.

Yours in Service,
MissKonstanz
~The Chaos Gremlin
Officer, Tamriel Savings Co.
Xbox NA/PC NA

Thank you guys really

Bobby_Digital81 · November 5

I'm glad you posted and update on this matter and it's being highlighted. It's sad that these addons were available to be used for as long as they were. I know the "Market Tracker- Guild Trader Pricing Assistant" had been in the list to download within the 1st week the addons were introduced on consoles. Not sure if it was available to PC users in the past years. But glad the right action was taken against this person.

Too bad there isn't an AI tool that is able to scan the code that is submitted when a new addon is added to the list or when an addon is updated. Can't imagine there are thousands or millions line of code of these addons, so think it would be something that is achievable. Then if the code gets flagged you have a handful of people review the code so that it's safe to have the community use.

I remember a month or so ago, there was an issue with ZOS's code that allowed all the guild history to be seen by all members of the guild, even if you didn't have the right permissions to view certain data. But all members were able to see Guild History like Bank Gold and Trader Bid history. This has been since resolved. But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds. That person that you posted about on this thread, had that "Data Extractor" addon, and I remember seeing it the day after his other addon got flagged, and I noticed that it gathered guild history, but didn't say how the data was used or what data was being extracted. So there should be someone or a program scanning for certain keywords to flag and make sure they don't end up for the community to use.

M0R_Gaming · November 5

Thank you so much to Dan, Seth, and anyone else involved on ZOS's end for the quick and strong action taken!
What the addon dev did was truly horrible, and it is sad that the library in question managed to slip below the radar for so long. It is great to see such action taken against the malicious developer!

Dolgubon · November 5

Some additional info

The malicious code in question was specifically in LibText, which was only available on console. However, the library was extremely barebones, and was probably only created as a vehicle for the malicious code. It could then be listed as a dependency for all the user's add-ons, thus increasing the likelihood that any particular user would have the code installed.

In addition to hiding the guild trader listings as mentioned by Kevin, it also hid any chat messages by the blacklisted players. For the author themself, it would actually still show the messages - but prefaced with a notifying text. Probably just so they could chuckle to themself any time they saw it.

Dolgubon · November 5

Bobby_Digital81 wrote: »

Not sure if it was available to PC users in the past years.

But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds.

It was never available on PC, it was a console only add-on.

It is also not possible for addons to see bid information when it is properly hidden. In terms of bid history, add-ons will only see the same thing that the user sees.

PeacefulAnarchy · November 5

Dolgubon wrote: »

Bobby_Digital81 wrote: »

Not sure if it was available to PC users in the past years.

But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds.

It was never available on PC, it was a console only add-on.

It is also not possible for addons to see bid information when it is properly hidden. In terms of bid history, add-ons will only see the same thing that the user sees.

I think the implication is that an addon installed by a guild leader could see what the guild leader sees, including bid history, and that info could then be surrepetitiously be sent by the addon to the author. I'm not sure if that is possible given what addons are restricted to be able to do.

Bobby_Digital81 · November 5

Dolgubon wrote: »

Bobby_Digital81 wrote: »

Not sure if it was available to PC users in the past years.

But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds.

It was never available on PC, it was a console only add-on.

It is also not possible for addons to see bid information when it is properly hidden. In terms of bid history, add-ons will only see the same thing that the user sees.

That's good news. Also, appreciate your awesome crafting addon. Think I speak for all console users that craft, that it has been such a great QoL addon for us.

sirinsidiator · November 5

Bobby_Digital81 wrote: »

I'm glad you posted and update on this matter and it's being highlighted. It's sad that these addons were available to be used for as long as they were. I know the "Market Tracker- Guild Trader Pricing Assistant" had been in the list to download within the 1st week the addons were introduced on consoles. Not sure if it was available to PC users in the past years. But glad the right action was taken against this person.

Too bad there isn't an AI tool that is able to scan the code that is submitted when a new addon is added to the list or when an addon is updated. Can't imagine there are thousands or millions line of code of these addons, so think it would be something that is achievable. Then if the code gets flagged you have a handful of people review the code so that it's safe to have the community use.

I remember a month or so ago, there was an issue with ZOS's code that allowed all the guild history to be seen by all members of the guild, even if you didn't have the right permissions to view certain data. But all members were able to see Guild History like Bank Gold and Trader Bid history. This has been since resolved. But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds. That person that you posted about on this thread, had that "Data Extractor" addon, and I remember seeing it the day after his other addon got flagged, and I noticed that it gathered guild history, but didn't say how the data was used or what data was being extracted. So there should be someone or a program scanning for certain keywords to flag and make sure they don't end up for the community to use.

Something like you imagine is currently being worked on by the upstanding add-on creators mentioned in the OP. It will allow to scan addons for all kind of things, from honest mistakes to suspicious code, which should hopefully prevent something like this from happening again.

Konstanz · November 5

Bobby_Digital81 wrote: »

I'm glad you posted and update on this matter and it's being highlighted. It's sad that these addons were available to be used for as long as they were. I know the "Market Tracker- Guild Trader Pricing Assistant" had been in the list to download within the 1st week the addons were introduced on consoles. Not sure if it was available to PC users in the past years. But glad the right action was taken against this person.

Too bad there isn't an AI tool that is able to scan the code that is submitted when a new addon is added to the list or when an addon is updated. Can't imagine there are thousands or millions line of code of these addons, so think it would be something that is achievable. Then if the code gets flagged you have a handful of people review the code so that it's safe to have the community use.

I remember a month or so ago, there was an issue with ZOS's code that allowed all the guild history to be seen by all members of the guild, even if you didn't have the right permissions to view certain data. But all members were able to see Guild History like Bank Gold and Trader Bid history. This has been since resolved. But the reason I bring this up, is because I hope that addons can't be written to extract data like certain guild history so other guilds can gain an advantage to outbid other guilds. That person that you posted about on this thread, had that "Data Extractor" addon, and I remember seeing it the day after his other addon got flagged, and I noticed that it gathered guild history, but didn't say how the data was used or what data was being extracted. So there should be someone or a program scanning for certain keywords to flag and make sure they don't end up for the community to use.

We ate TSC are about 2-3 weeks away from releasing a companion addon to the TSC price checker that allows individual users to submit their sales data from their guilds for their sales. This will have to be triggered manually each time. And due to the constraints of the Console data, will only be updated every tuesday. As all data is still manually hand checked and verified for accuracy.

If you want to know more, just DM me

Yours in Service,
MissKonstanz
~The Chaos Gremlin
Officer, Tamriel Savings Co.
Xbox NA/PC NA

code65536 · November 5

ZOS_Kevin wrote: »

We want to end with a thank you to our add-on creators who raised this issue with us and were patient as we worked toward a resolution.

And thank you for acting swiftly on this: this issue was raised in the evening, and action to remove the offending addons was taken the very next morning.

For some additional context, as @Dolgubon had already mentioned, the offending addon was available only on console. On PC, it was always possible for anyone to open up an addon and look at its code, which was a very strong safeguard and deterrent against this sort of thing and is, I believe, a major reason why there's been no history of such things happening on the PC side.

Unfortunately, when console addons were initially released, there was no practical way for someone to download a console addon to look at the addon's code. However, @sirinsidiator recently created a tool that lets anyone easily download any console addon, and a few days later, this led to the discovery of the offending author having plagiarized a PC addon, which in turn brought about more scrutiny on this person's other uploads, which uncovered the malicious code.

Now that people are able to inspect the code for console addons just like they could for PC addons, I hope that this is the first and last incident of this sort.

PeacefulAnarchy wrote: »

I think the implication is that an addon installed by a guild leader could see what the guild leader sees, including bid history, and that info could then be surrepetitiously be sent by the addon to the author. I'm not sure if that is possible given what addons are restricted to be able to do.

Yes, what you describe is possible in theory. But in this case, the malicious addon here did not do this.

Techwolf_Lupindo · November 5

Did ZOS added code to ban AddOns somehow? I use minion and esoui to find addons. I don't think ZOS can banned stuff on third party sites.

bobdrad · November 5

Thank you for your action and disclosure regarding this unfortunate situation.

I think this type of situation could very easily be rectified by having the Bethesda site which advertises mods (console add-ons) also provide the source, just as all PC users have access. While it's laudable that the dev community created a tool to do this, it shouldn't be necessary, and requiring use of such a tool creates a barrier for easy detection of malicious code.

Part of the process for publishing a mod should cause the latest source to be made publicly available automatically. This would make it less attractive for devs to attempt writing malicious mods by making it easier for malicious code to be detected.

spartaxoxo · November 5

Techwolf_Lupindo wrote: »

Did ZOS added code to ban AddOns somehow? I use minion and esoui to find addons. I don't think ZOS can banned stuff on third party sites.

Console add-ons are managed by ZOS because consoles are closed.

code65536 · November 5

Techwolf_Lupindo wrote: »

Did ZOS added code to ban AddOns somehow? I use minion and esoui to find addons. I don't think ZOS can banned stuff on third party sites.

As mentioned, the malicious addons were exclusive to console. All console addons are distributed by Bethesda, not by a third-party, which is why only ZOS could take action against these addons. (ESOUI.com and Minion are only for PC users.)

Dack_Janiels · November 5

code65536 wrote: »

Techwolf_Lupindo wrote: »

Did ZOS added code to ban AddOns somehow? I use minion and esoui to find addons. I don't think ZOS can banned stuff on third party sites.

As mentioned, the malicious addons were exclusive to console. All console addons are distributed by Bethesda, not by a third-party, which is why only ZOS could take action against these addons. (ESOUI.com and Minion are only for PC users.)

If I’m remembering this right, ZOS does have the ability to disable any addon from loading in game. They added that back when the NodeDetection lib in HarvestMap was crashing people a couple years ago.

tincanman · November 6

Awesome detection work by add-on developers and the subsequent alacritous action taken by zos. I had no idea that console add-on scripts were not as trivial to read as the pc ones, so the discovery is all the more impressive.

It seems to have been a bit rough on a few in particular but commendable courage of convictions despite this. I hope everything settles down soon for all, particularly since the identified bug seems to have been effectively squished.

Sharlikran · November 6

ZOS_Kevin wrote: »

As noted before, these add-ons should no longer be an issue. If you see any add-ons that you suspect could violate the ESO Terms of Service, please make sure to file a support ticket with us and report the add-on.

We want to end with a thank you to our add-on creators who raised this issue with us and were patient as we worked toward a resolution.

Kevin, I have been working with Bethesda since 2012 and Fallout 4 came out in 2015. The link you provided once you follow it to report a mod for copyright violation will take you to a Fallout 4 page.

Also you cannot report a mod that way because it tells you to use the mods page for Bethesda.net. Again reiterating, it's talking about Fallout 4.

Would you please provide an updated link for ESO.

Ingenon · November 6

Thanks to everyone involved with clean up! Separately, I think I read about adding capability for us PS/NA players to get prices for our server, and I'm looking forward to that if it ever happens.

RedJohn_COF · November 6

ZOS_Kevin wrote: »

Hi Everyone,

For those who use and create add-ons for ESO, we have an update regarding harmful add-ons created by an add-on creator. We recently took disciplinary action against an add-on creator due to several Terms of Service violations. Specifically, add-ons that included malicious content and the related disruption impacting many upstanding ESO add-on creators. These add-ons have been removed, and the ESO account has been banned. We have added a list below to highlight the ones we took action against.
Market Tracker- Data Loader

Writ Cost Calculator- Know the cost before you craft

Back To Keyboard- Prevents AFK and Inactivity Disconnect

Market Tracker- Guild Trader Pricing Assistant

Data Extractor

Fast Warp Optimizer – Unlock Every Wayshrine for Zero Gold

LibText

Some of these add-ons included malicious content that could negatively impact players. This directly impacted those who had them installed and indirectly impacted players who did not have them installed. Most notable of these add-ons being Market Tracker and LibText. As a part of the resolution process, if you had any of these add-ons active, they have been removed and are no longer usable on your account. These add-ons are also no longer available to add to your account.

Normally, we do not disclose user violations. However, we feel it’s important to highlight why we took action in this case. Additionally, for those who used add-ons from this author, you should know how these add-ons may have impacted your account.

The violations include:
Malicious content in add-ons: The usage of malicious content in an add-on could cause issues for potential add-on users. For example, having a hidden blacklist applied to the add-on.

Usage of a hidden blacklist within the add-on: As an example of malicious content, having a hidden blacklist could cause issues for other players. For example, players added to this blacklist would not show up in certain public contexts for anyone who had the add-on installed, like appearing on Guild Traders.

Failure to publicly disclose all elements of the add-on to all potential users.

Repurposing other creators’ add-ons and their work, claiming them as their own and reposting them.

As noted before, these add-ons should no longer be an issue. If you see any add-ons that you suspect could violate the ESO Terms of Service, please make sure to file a support ticket with us and report the add-on.

We want to end with a thank you to our add-on creators who raised this issue with us and were patient as we worked toward a resolution.

If something like this can happen, why isn't there some kind of verification progress so that users can be sure those add ons are safe to use? Especially now that you can install them as easily on console, there should be something.

Or just make it 2 way. Mods that have been uploaded to the bethesda mod servers, will be verified, and those mods that people just 'sideload' aren't.

code65536 · November 6

RedJohn_COF wrote: »

If something like this can happen, why isn't there some kind of verification progress so that users can be sure those add ons are safe to use? Especially now that you can install them as easily on console, there should be something.

Or just make it 2 way. Mods that have been uploaded to the bethesda mod servers, will be verified, and those mods that people just 'sideload' aren't.

You can't sideload addons on console. The only way to get an addon onto a console is via Bethesda. This means that someone who is developing an addon for console and doesn't have the PC version of the game to test the addon with, any change that is made can only be tested by uploading the addon to Bethesda. This is why some console addons could have dozens of updates in a single day.

Adding verification would be very labor intensive and would also add a lot of extra friction to console addon development.

And PC addons aren't really verified, either. There are some very cursory checks by ESOUI, but there isn't a detailed examination of what an addon does, which is how some AI-generated addons that were horribly broken got listed on ESOUI recently (they were quickly reported and taken down, however).

But despite the lack of screening, there have been no incidents of malicious PC addons* (the AI-generated ones were comically non-functional, but not malicious), because being able to view the code means that malicious code will eventually be discovered, and the uploader will then have to face the consequences, and this transparency has proven itself over the course of the past decade to be an effective deterrent on the PC side of things.

As I wrote earlier, such a deterrent did not initially exist on console since console addons were initially "black box", which led this malicious uploader to think that they could get away with it, but now that has changed (and the person here made an example of), I doubt that there will be a repeat of such an incident.

* Edit: A fellow addon dev pointed me at an incident from 2014--from the days before I got into addons--where a malicious addon was stealing gold, but this was quickly caught, and ZOS locked some things down to prevent this from ever happening again.

DenverRalphy · November 6

I fully support the stance taken here, and applaud the efforts put forth and presented here as well. Great job!

However, I think there should be some care with how the bad faith addons are beinig described. Console users by and large are used to operating within a secure bubble. The users/players hear the word "Malicious", and they instinctively envision viruses, stolen passwords, deleted files, etc.

I know of a few console players who simply won't use addons because they don't feel safe with them after the Autosave problems during the initial addon deployment. I fear this may strengthen that position without some care.

code65536 · November 6

DenverRalphy wrote: »

Console users by and large are used to operating within a secure bubble. The users/players hear the word "Malicious", and they instinctively envision viruses, stolen passwords, deleted files, etc.

Well, those are things that addons simply can't do. They can't steal passwords, brick your system, or anything else that pierces past the bubble of the game. But while addons can never attain that level of malice, they can still do some bad things.

For example, addons have the ability to destroy items in your inventory. This is useful for addons that assist in inventory management, for automatically destroying unwanted trash items, and there is a fairly popular addon on PC that does this sort of thing, but it means that addons can also destroy high-value items, either through intentional malice or an unintentional mistake.

A dose of caution regarding addons is not necessarily a bad thing.

DenverRalphy · November 6

code65536 wrote: »

DenverRalphy wrote: »

Console users by and large are used to operating within a secure bubble. The users/players hear the word "Malicious", and they instinctively envision viruses, stolen passwords, deleted files, etc.

Well, those are things that addons simply can't do. They can't steal passwords, brick your system, or anything else that pierces past the bubble of the game. But while addons can never attain that level of malice, they can still do some bad things.

For example, addons have the ability to destroy items in your inventory. This is useful for addons that assist in inventory management, for automatically destroying unwanted trash items, and there is a fairly popular addon on PC that does this sort of thing, but it means that addons can also destroy high-value items, either through intentional malice or an unintentional mistake.

A dose of caution regarding addons is not necessarily a bad thing.

Oh yes I fully agree.

I'm just positing that using the term Malicious in a headline, while accurate, may be a bit strong. I am by no means trying to downplay the importance of the topic. Just advising a bit of caution when it comes to a playerbase less familiar so as to not lose their participation.

Even before consoles had addons, there are still a lot of players who fully believe that addons by nature can result in a ban. I'd hate to add fuel to that fire as well.