[!WARNING] Final verdict available at the end of this report.
The static scan examined every one of the 438 classes inside the JAR and successfully de‑compiled all of them – there were no parse or decompiler failures. It identified 40 classes (≈9 % of the total) that contain patterns often worth a closer look, such as file‑system access, reflection, native library loading, cryptographic calls, and outbound network usage.
Most of those patterns belong to the mod’s own Steam‑integration code and to bundled configuration libraries (nightconfig, quilt‑config, kaleido‑config). The scanner also flagged two archive entries that contain hard‑coded URLs pointing to the project’s GitHub pages and to common open‑source sites (Apache, Maven Central).
Overall, the evidence points to normal behaviour for a Minecraft Forge mod that talks to Steam services, reads/writes configuration files, and loads a native Steamworks library. No clear signs of malicious payloads (e.g., credential stealing, hidden downloads, or system‑level command execution) were found.
No high‑signal malicious behavior was detected.
The scan did not find any code that reads user credentials, writes hidden files, launches external processes, or contacts suspicious domains. The only outbound activity is directed at Steam’s networking APIs and to well‑known open‑source URLs.
The evidence does not match the pattern of a remote‑access trojan. While the mod opens sockets to communicate with Steam services (expected for a Steam‑enabled mod), there is no indication of arbitrary command execution, persistence mechanisms, or data exfiltration beyond normal game‑related traffic.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
link.e4steam.Agnos |
Low | Reads configuration directory and its own JAR path | java_nio_files_api |
link.e4steam.Doctor |
Low | Reads config files, uses crypto API (likely for token handling) | java_nio_files_api, crypto_api |
link.e4steam.MinecraftUiCompat |
Medium | Uses reflection and class‑loader tricks to build UI components | reflection_api, classloader_api |
link.e4steam.MinecraftVersion |
Low | Reflective call to obtain current game version | reflection_api |
link.e4steam.Mirror |
Low | Reflection‑based helpers for chat events and text components | reflection_api |
link.e4steam.steam.SteamClientBridge / SteamConnectionBridge / SteamLobbyManager / SteamLoopbackAuthentication / SteamRuntime / SteamUdpBridge |
Medium‑High | Opens sockets to Steam servers, loads native Steamworks library, performs crypto checks | socket_api, native_load_api, crypto_api |
link.e4steam.steam.SteamInvitationAuthorizer |
Low | Crypto‑based token verification | crypto_api |
link.e4steam.steam.SteamNativeLibraryLoader |
Medium | Loads native .dll/.so files, verifies their hash |
native_load_api, crypto_api, file I/O |
link.e4steam.steam.VoiceChatUdpEndpoint |
Low | Reads/writes local port files, uses reflection for class loading | java_nio_files_api, reflection_api, classloader_api |
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
nightconfig and quiltconfig classes (e.g., ConfigParser, ConfigWriter, ConfigImpl, ReflectiveConfigCreator) |
Low | Read/write configuration files, optionally load from URLs, use reflection for dynamic type handling | java_nio_files_api, url_connection_api, reflection_api |
ReflectiveConfigCreator |
Low | Contains a hard‑coded GitHub URL (issue tracker) – only for documentation | hardcoded_external_url |
Various kaleido config helpers |
Low | File I/O for TOML/JSON config files | java_nio_files_api |
socket_api used by several link.e4steam.steam.* classes to talk to Steam’s networking services. http_url_literal and url_connection_api appear in configuration libraries that can read a config from a URL – these are optional and not automatically invoked.Yes, the JAR is a Forge mod that adds Steam integration to Minecraft. Its behaviour (reading config files, loading a native Steamworks library, opening sockets to Steam, and using reflection for UI helpers) matches what the mod advertises. There is no hidden downloader or malicious payload.
META-INF files point to the project’s GitHub pages – typical for open‑source mods. configDir(), jarPath()). Static analysis can see what the code does but cannot guarantee runtime safety. It cannot detect malicious behavior that is triggered only under specific conditions, nor can it prove the native Steam library itself is free of vulnerabilities. Always combine static results with good sourcing practices and, when possible, runtime monitoring.
Yes, a JAR can embed malicious Java code or native libraries that act like a virus, but many JARs are perfectly benign. Scanning helps identify risky patterns.
Download it from a reputable source, scan it with a trusted static analyzer (like the one used here), and, if possible, run it in a controlled environment to observe its behaviour.
The scanner can flag code patterns typical of remote‑access trojans (e.g., arbitrary command execution, hidden downloads, persistence). In this report, no such patterns were found.
Obfuscation makes analysis harder and can be a red flag, but many legitimate developers use it to protect intellectual property. Absence of obfuscation does not guarantee safety, and presence does not prove malicious intent.
Verdict: Mostly trust
Risk level: Low‑to‑Medium
Confidence: High (based on full decompilation and lack of high‑signal malicious indicators)
Should I trust this JAR, and why?
The mod’s code is fully visible, and the only suspicious actions are legitimate file access, reflection, crypto, and socket communication required for Steam integration. All external URLs point to reputable open‑source sites, and no hidden download or credential‑stealing behavior was found. Assuming you obtained the JAR from the official project page or a trusted mod repository, it is safe to use in your Minecraft setup.