[!WARNING] Final verdict available at the end of this report.
This JAR scanner inspected continuity-3.0.0_1.21.jar, a small Fabric Minecraft mod JAR containing 63 classes and 338 methods. All 63 classes were parsed and decompiled successfully, so the scan had complete class-level coverage. The scanner identified six classes with indicators worth reviewing: three use local file APIs, two use reflection or Base64-related APIs, and one includes Java networking support.
The report also found several hard-coded web links. Most are project/community links in fabric.mod.json for Modrinth, GitHub, and Discord. One class contains a direct Discord CDN image URL, and another contains a method named downloadImage that can retrieve an image from a URL.
These findings need context. File access is common for Minecraft mods that store configuration or cached assets, and web links in mod metadata are normal. Reflection, Base64, and image-downloading code deserve closer inspection because they can be used legitimately or, in other circumstances, to make behavior harder to review.
No high-signal malicious behavior was detected.
The report contains no evidence of credential or token theft, browser-data access, hidden executable downloads, operating-system process execution, persistence mechanisms, destructive file operations, or clear data exfiltration. It also does not identify suspicious IP addresses, command-and-control servers, shell commands, or code intended to steal Minecraft account data.
The scanner did find a generic image-download method and a fixed image URL hosted on Discord’s CDN. That is network-capable behavior, but the supplied report does not show it downloading or executing programs, collecting private data, or sending user information elsewhere.
The evidence is not consistent with a remote-access trojan (RAT).
There are no reported indicators of remote command execution, command shells, hidden background persistence, keyboard/input capture, credential collection, or an unexplained connection to a remote control server. The detected networking is limited to URL-related APIs and known project/community or image-hosting links.
All flagged classes are under the me.pepperbell.continuity package, which appears to be the mod’s own code rather than an unrelated shaded library.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
CtmClientDbConfig |
Low | Reads or creates local directories for a DB/config path | Uses Java NIO file APIs in getDbPath() and ensureParentDirectories() |
AtlasMixin |
Low / reviewable | Uses reflection to modify screen-title or category-name behavior | Reflection in wipeScreenTitle() and wipeCategoryNames() |
CtmHandler |
Low | Reads or caches/restores an icon file | Java NIO file API in continuity$cacheAndRestoreIcon(...) |
CtmScreens |
Moderate review item | Contains a Discord CDN image URL and local file access | Fixed icon URL in constructor; file API in a button action |
BaseCtm |
Low / reviewable | Uses Base64-related processing in an explicitly named obfuscation helper | Base64 API in ofObf(byte[] obfuscated, int key) |
CtmImageUtils |
Moderate review item | Can download and decode an image from a supplied URL | Java URL networking API in downloadImage(String url, int w, int h) |
The scan does not identify suspicious bundled third-party libraries. In particular, there are no flagged classes from common shaded components such as bStats, HSQLDB, SLF4J, Apache Commons, or HikariCP.
The report found these external destinations:
https://modrinth.com/mod/continuity — the mod’s Modrinth page.https://github.com/PepperCode1/Continuity — the project’s GitHub repository.https://github.com/PepperCode1/Continuity/issues — the project issue tracker.https://discord.gg/7rnTYXu — a Discord invite/community link.https://cdn.discordapp.com/attachments/997440120896639089/1077920680391213086/icon.png — a specific image hosted on Discord’s CDN.The first four links are stored in fabric.mod.json, which is normal mod metadata used to show users where the project, support, and source code are located.
The Discord CDN image URL appears in CtmScreens, and CtmImageUtils.downloadImage(...) can fetch images using Java’s URL API. The report does not show any unknown host, raw IP address, upload endpoint, or evidence that the mod sends local data outward. It also does not prove when, whether, or how often the image-download function is called.
The scan coverage is strong:
There are no reported decompiler failures, malformed classes, default-package classes, or complexity anomalies that would prevent inspection. This is useful because it means the flagged code was not hidden behind decompilation errors.
The scanner did flag one Base64-related helper named ofObf, plus reflection in two mixin methods. These APIs can make code somewhat harder to review, but their presence alone is not proof of malicious obfuscation. The method names and reported purposes are not inherently RAT-like.
This appears to be a Fabric Minecraft mod: its archive contains fabric.mod.json, and its code is under the Continuity package namespace.
For a client-side Minecraft mod, local config/cache files, mixins, GUI handling, texture/icon handling, and links to Modrinth, GitHub, and a support Discord are all plausible normal functionality. The main item to be aware of is that the mod includes code capable of downloading an image from a URL, with one known Discord CDN image URL embedded in the code.
fabric.mod.json are normal project/support metadata.wipeScreenTitle and wipeCategoryNames, suggesting UI-related changes rather than system control.No major malware red flags were reported.
The only unresolved behavior worth noting is the generic downloadImage(String url, int w, int h) method. A generic downloader can be safe when it is only used for visual assets, but static scanning alone cannot establish every runtime URL passed into it. The report shows one specific Discord CDN image URL, not an unknown download server or executable payload.
The Base64-related ofObf method also merits normal caution because encoding/obfuscation can conceal strings or data. However, the report does not connect it to network communications, stolen data, remote commands, or hidden downloads.
6bb7ef520ac25ba3563c0579c44844c9d219a001bbceae05f1600adbe57b4509.Static JAR scanning reduces risk by inspecting code, strings, APIs, and embedded links, but it cannot prove a file is completely safe. It cannot fully determine runtime behavior, server-provided content, every code path reached in Minecraft, or whether an external service changes what it hosts later.
A clean-looking report is therefore useful evidence, not a guarantee. Download source, project reputation, signatures or hashes, and keeping backups remain important.
Yes. A Java JAR can contain malicious code, including credential theft, unwanted downloads, destructive file operations, or remote-control features. This report did not detect those high-signal behaviors in this JAR.
Use a JAR malware scanner, inspect the download source, verify hashes where available, check the project’s official page and source repository, and test unfamiliar files in a separate Minecraft instance. For this file, the scanner successfully inspected all 63 classes and found no failed decompilation areas.
It can detect common RAT-related warning signs, such as remote command execution, suspicious network destinations, persistence, credential theft, hidden downloads, or process execution. None of those indicators are reported here.
No. Developers may use encoding, compact code, or reflection for legitimate reasons. In this report, the JAR has no decompiler anomalies or failures, and the Base64-related helper alone is not enough to establish malicious obfuscation.
Verdict: Mostly trust
Risk level: Low to moderate
Confidence: Moderate to high
Should I trust this JAR, and why? The scan found no evidence of credential theft, remote control, hidden payload downloads, process execution, persistence, or destructive behavior. All 63 classes were successfully inspected, with no decompilation failures or anti-analysis anomalies. The external links mostly point to expected Continuity project and community pages, while the only content-download indicator is a Discord-hosted image and a generic image-downloading utility. Local file access, mixin reflection, and config/cache handling are plausible normal functions for a Fabric client mod. Static analysis cannot guarantee complete safety, but this report provides no strong reason to treat the JAR as malware.