I've saw recently my friend's server has been given a "Rare Plugin" which DELETES every server files in your server once it's run, including plugins, resource packs, worlds...etc. Is that really possible? How?
yes, it basically just rm rf everything it can there's even unconfirmed claims of plugin that encrypt everything and asks for a ransom from some chinese forums so please be careful when running plugins
my point begin there's crazy and dangerous plugins that exist in the wild there probably have family of malicious plugin scattered
And one more scaring fact is that many (or even most?) server owners are running their PocketMine server under root account which can lead to more big trouble.