My mod was stolen and offered as original work

In 2019, a user by the name of L3X4R'S wanted me to "give [them] the code" for my Red Dead Redemption 2 mod, claiming their anti-virus was acting up. For the answer, you can read the full chat history attached below!

The user later requested me to approve their unrelated file on PCGamingWiki, so I had to check the content, only to find that it was a packaged version of the published findings (bytes) from other users. I asked to credit.

In 2020, the user also asked trivial questions, like how to convert an aspect ratio float to hexadecimal or vice versa, indicating they had zero knowledge of hacking games for ultrawide.

Time after time I looked at the code or bytes of their patchers and trainers, only finding the already publicly available bytes and zero attribution (from WSGF or forums like the Shenmue Dojo). The user advertised their YouTube channel and put "Lexar's" in the tools' descriptions. On some occasions I asked about this but the user was dishonest, claiming that they always credit the authors, changing the description after my inquiries on one or two occasions.

I reported those to Nexus to no avail.

The user was part of the reason I was not eager to publish the bytes behind my simple patchers, as I did not want them to be stolen and packaged, attracting users only for them to find the tools unusable after an update, as the user would be unable to maintain.

Today I got a message,

esteady1 — Today
@Rose  has a mod of yours been stolen without credit again? See dsogaming article 

The article published today claims that it's the "first mod" that adds "Ultra Wide support" and that it's created by WT3WD. This is the NexusMods username of L3X4R's.

Nowhere in the article or on the mod page does it mention my name or that my patcher was released the minute the game was released to the world.

I knew of L3X4R'S history but I still had to ensure that the patcher was a copy of mine. Lo and behold, the bytes targeted were identical. The user couldn't know my whole pattern, so the search pattern was narrower but the content of the fix itself was identical and not possible to have been achieved by chance. There are multiple ways to a solution and also multiple ways to go about it - for example, one may change a byte of an operation to break the condition, while another would just make the whole operation nonfunctional. Not the case here at all.

I proceeded to report the mod as stolen via Nexus and sent them an email. On Discord, they essentially told me to wait for a response. I'm not hopeful because I know of my prior attempts regarding others' work being ignored by this site. They make money from what they host, so no wonder.

I also submitted copyright claims to YouTube (first taken down, "This video is no longer available due to a copyright claim by Rose.", later "removed by the uploader") and Dropbox where the user hosts a backup of their patcher.

Oh, and did I say they also ask for PayPal donations for this?

I'm not sure where to go from here though. I've always tried to keep my work as open as possible without outright making it open source - accessible to anybody with basic knowledge of hex editing or reverse engineering, but also hidden from the laziest thieves. Do I have to move away from patchers and onto trainers full time, making the experience less inconvenient for the users? Do I obfuscate the code?

Edit: I got in touch with DSOGaming who corrected the article for the most part, removing the video, fixing the link, and crediting PCGamingWiki, though for some reason keeping the thief's name (crossed out). Not entirely happy with this either, but it's tolerable and it's not my job to do their work.

Edit 2: I looked up the user's donation email only to discover that they had another NexusMods account, banned in 2016 for stealing at least 20 The Witcher 3 mods. There is more concrete and undeniable proof beyond the names being a match, but I'm reserving that for my message to Nexus in case the user ends up joining here to have a read!

Edit 3: The mod is now removed as well, though I'm not sure if it was by the Nexus team or the user.

Edit 4:  Lexar's account WT3WD is now banned on Nexus.