Security concern with Curic Section Lite

Extensions
,
1

I noticed something that concerns me in Curic Section Lite for SketchUp 2026.

If you go to Curic Section Lite → Help → Documents, you are directed to a page containing a suspicious PowerShell command.

The command downloads a .ps1 file from chibigalacticstar.cfd and executes it with PowerShell hidden and ExecutionPolicy Bypass.

This seems highly suspicious to me, especially since the link is reached directly through the Curic Section Lite Help → Documents section.

I have contacted Curic to ask whether this is legitimate and whether the domain is officially associated with them.

Has anyone else encountered this? I would be interested to hear if other SketchUp/Curic users are seeing the same thing.

2

Odd

the domain you mention was registered 2 days ago and has only been active since yesterday
https://websafely.app/analysis/chibigalacticstar.cfd

@curic4su any idea ?

3

Capture d’écran 2026-09-11 à 12.31.12
Capture d’écran 2026-09-11 à 12.31.12643×309 17.9 KB

I checked, clicking on Documents first tried to send me to https://curic4su(dot)com/su_plugins/community.html

then it tried to redirect but to a different domain. and ublock was on the case

Capture d’écran 2026-09-11 à 12.32.36
Capture d’écran 2026-09-11 à 12.32.36418×278 16.7 KB

a second try, a second domain.

@Felix.E you’re onto something, but I don’t think it’s in the plugin itself, it looks like @curic4su 's website got hacked and tries to redirect users to various domains.

in fact, just going to https://curic4su(dot)com/ will try redirecting you.

a quick google search gives me curic.io as a new website. maybe he just forgot to change the link to the old hacked website ?

4

This is a bit concerning and curic has many plugins. Is this specific to this plugin or a concern of the author?

5

the way I see it, it’s an old plugin that hasn’t been updated in some time, and it contains a link that used to be valid but now that curic changed domain name and website, it’s not anymore.

it looks like a classic internet situation where a link now points to a dead / corrupted thing because people move on.

I have a few old domains from older projects that I have abandoned and that other have take over.

6

Answer from Curic support:

Thank you again for reporting this issue.

After further investigation, we confirmed that an older version of Curic Section Lite could direct users to our former domain, `curic4su.com`, when selecting **Help → Documents**.

This domain is no longer Curic’s official website and should not be considered a trusted Curic resource. Our current official domain is:

**https://curic.io**

The PowerShell command and the domain `chibigalacticstar.cfd` are not part of Curic Section Lite and are not associated with Curic. The suspicious command was most likely presented through an unsafe redirect involving the former domain.

7

Did you find a newer version of this extension ?