It&#x27;s actually worse than the online post here indicates. There was another &lt;script&gt; tag at the bottom of the page that had remained there, seemingly missed after the password theft script had been removed.<p>Ultimately I think the site&#x27;s been serving foreign (potentially malicious) JS for about two months with Curse having been aware for probably a month without users being informed. The password theft script was definitely there for at least a month before it was removed. It&#x27;s great to hear Curse are working on a bug bounty programme but I as I mentioned in IRC it&#x27;s disappointing to see such a big company respond like this.<p>There&#x27;s some more information available from the channel IRC logs: <a href="https:&#x2F;&#x2F;korobi.io&#x2F;network&#x2F;esper&#x2F;channel&#x2F;bukkit&#x2F;logs&#x2F;2015&#x2F;12&#x2F;07&#x2F;#L268" rel="nofollow">https:&#x2F;&#x2F;korobi.io&#x2F;network&#x2F;esper&#x2F;channel&#x2F;bukkit&#x2F;logs&#x2F;2015&#x2F;12&#x2F;...</a>