Hijacking of Popular Minecraft Launcher by Rogue Developer Raises Malware Fears

Members of the Minecraft community using the PolyMC custom launcher are being told to switch to a different launcher after the owner removed contributors from the project in an attempt to “reclaim” PolyMC from people who promote queer and leftist ideology online.

According to a report from GamingonLinux, the owner, who goes by the username LennyMcLennington on the developer hosting site GitHub, revoked these contributors’ permissions yesterday alongside an update titled “reclaim polymc from the leftoids.”

When the update went live, members of the Minecraft community initially thought this was due to a security issue and that the main keyholder had been compromised, but LennyMcLennington has since posted an update on the PolyMC Discord (which IGN has verified) that links both a paste.gg page and GitHub file signed with their PGP signature saying their accounts were not compromised, and they were “just not hiding what [they] believe anymore.”

IGN was able to confirm the update on GitHub, the page.gg and GitHub file, but the original Discord message screenshot in GamingonLinux’s report saying LennyMcLennington removed contributor permission from those who were “promoting radicalist leftist queer ideology” didn’t show up in our initial searches, meaning it may have been deleted or posted in a private channel on the server, but is still unconfirmed as of this writing.

Following the takeover, Minecraft community members are urging others to switch to a different launcher, both on an ideological level and as a precautionary measure. As GamingonLinux points out in its original report, using PolyMC requires giving the launcher certain permissions with your Microsoft account, and the launcher is essentially run by one person now, though LennyMcLennington has been recruiting new contributors through the PolyMC Discord server.

While some fear PolyMC may be untrustworthy, LennyMcLennington also said in the Discord “there’s no malware risk” after this takeover, and they will be vetting the work of any new contributor to ensure the launcher remains safe for its users. 

“I’m not going to let anyone contribute code to PolyMC unless I have checked all of the code to make sure it is safe,” the user wrote on Discord. “All I’m doing now is seeing if anyone is interested in contributing so I can communicate with them if they need any help contributing or have any questions about the code base.”

Prior to this, LennyMcLennington was seen on GitHub arguing to remove qualifiers for protections for marginalized people from the PolyMC Code of Conduct back in May, calling the inclusion of race, religion, sexual orientation, and other descriptions “repetitive” when these protections were already said to apply to “everyone.” Though, users were quick to point out that without the specifics in writing, some people were free to interpret “everyone” loosely.

While this story has put the community in distress, Minecraft has been a haven for fan creations, mods, and launchers, which has contributed to the game’s longevity over the years. The tools available to players are so extensive that a fan created the entire known universe in Minecraft. Developer Mojang is pretty hands-off with what players create, but did take a hard stance against NFTs and Blockchain technology earlier this year.

Kenneth Shepard is a writer covering games, entertainment, and queerness all around the internet. Find him on Twitter at @shepardcdr, and listen to his biweekly video game retrospective podcast Normandy FM, which is currently covering Cyberpunk 2077.