Then find out where it comes from. Don’t blatantly upload everything you get. You don’t want to pirate plugins, so ask him where he got it from. If it was bought from CoderHire and only used on your server (so your friend didn’t give to anyone else), you’re fine. If he shares it with multiple people, you’re wrong, and so is he.
If it’s a leaked plugin, no one is going to help you. Maybe someone can confirm which addon this NPC came from?