Mohist VS Website

https://mohistmc.com/,

If you want to run Bukkit plugins with Forge, there's a few options. Mhoist, Magma and Arclight all achieve the same goal of running Bukkit plugins with Forge. Mhoist and Magma have both existed longer than Arclight, however Arclight uses mixins, which can improve compatibility.

https://mohistmc.com/ This one can load both forge mods and spigot plugins at the same time. But keep in mind once there is forge mods in your server, your server's direction will and should be focus on the mods instead of the plugins. So far EssentialsX-type of "tool chain" "server management" plugins can install just fine. Plugins that mess around the the base game mechanics like item adders and slimefun are likely to give unexpected behaviors.

After little research I found you this: Project that allow forge mods server to utilize spigot pluggings.

I know that CoreProtect is a Spigot plugin, and that forge is a different beast entirely. But I've looked into Mohist (https://github.com/MohistMC/Mohist) and it looks like it has what I need, though not really any support for 1.19 quite yet.

Looking in to MohistMC but is also out of date.

Instead of fully switching to MOD server, you could try using Magma, Sponge, or Mohist, if you have any further questions, feel free to reply to this message or DM me.

I’m no expert, but in terms of running forge servers, I’ve had good luck with MohistMC. https://mohistmc.com/

The reason the EssentialsX devs found out about this dangeous behaviour was them or someone else manually going through the code, something few actually do. A lot of people simply take ”open source” as a synonym for safe, while some take the effort to go through the code and identify sus things like this commit.

I think you can see it in different ways (Do not trust Essentials' PSA "Do not use mohist"), but I prefer to know what I am running. The idea to replace files with compatible ones is a security issue, but I admit I would have done it the same way if I ran into this problem. My bigger problem with Mohist is the mentality, eg. that they tried to change Essentials' PSA into an ad (Pull Request - Reference). But I think, if mohist works well for you, and you (if possible) do not replace the plugin jars by Mohist's, it is okay to use. It is just something you should be aware of.

so yes

Magma has a dev who exploits the log4j rce thingy. Mohist replaces plugin with arbitrary unknown code, then tried to advertise themself by submitting a PR to EssentialsX's Mohist PSA github