DeckyHub › Plugins › Known issues

Known plugin issues

187 of 556 Decky Loader plugins have a virus scan finding, a warning from Decky Extended Plugins' audit or a version mismatch. DeckyHub shows the scan and audit notes in the app before you install; they inform and never block.

A warning isn't proof a plugin is harmful, and no warning isn't proof it's safe. Open a plugin's page for its scans, and check its repository before installing. Updated daily.

Threat found 1

A virus scanner (ClamAV, YARA, VirusTotal or MetaDefender) flagged its ZIP.

Reads private data 55

Its code reads Steam login data, SSH keys or secrets from the environment.

Changes system startup 101

It edits shell profiles, preloads libraries, loads kernel modules or adds device rules, which keep working outside Decky.

Code not in its repo 121

The release ZIP has scripts or programs that aren't in its GitHub source, so you can't read what they do.

Hidden code 30

It contains encoded or packed code that's hard to read.

Skips HTTPS checks 17

It turns off certificate checks, so what it downloads could be tampered with.

Runs downloaded scripts 17

It downloads a script and runs it straight away.

Known vulnerabilities 31

It bundles libraries with published security flaws.