[!WARNING] Final verdict available at the end of this report.
This JAR scanner inspected all 44 classes in essentialpatcher-1.21.11-Fabric-1.0.7.jar, including all 242 methods containing code. Every class parsed and decompiled successfully, with no malformed archive entries, decompiler failures, or decompiler anomaly warnings.
The scan marked 9 classes for review. The main signals are local file access, reflection used for Minecraft/mod compatibility, and HTTP networking to https://cosmetics.leclowndu93150.dev. The networking code includes cosmetic synchronization actions such as authentication, session joining, fetching cosmetic data, sending cosmetic outfits, and heartbeat requests.
These signals need context: file access is expected for mod configuration and saved cosmetic outfits; reflection is common in Fabric mixins and compatibility code; and networking can be normal for an online cosmetics feature. The relevant class and method names provide useful evidence about what each flagged capability is intended to do.
No high-signal malicious behavior was detected.
The report contains no indicators of credential theft, token grabbing, hidden payload downloads, operating-system process execution, destructive file deletion, startup persistence, remote shell commands, or obvious data exfiltration. The JAR does access local files, but the identified methods are named for saving/loading configuration and cosmetic outfits.
The mod does send and receive data over HTTPS for its cosmetics synchronization feature. The visible method names indicate that this traffic is related to authentication, sessions, syncing outfits, applying cosmetics, and heartbeat activity—not arbitrary command execution. Static analysis cannot determine every exact field sent in those requests, so users should still be aware that using the online cosmetics feature involves contacting its service.
The evidence is not consistent with a remote-access trojan (RAT).
There are no reported process-launching APIs, remote command handlers, persistence mechanisms, hidden downloader behavior, or classes suggesting remote desktop/control functionality. The detected network client is specifically associated with cosmetic synchronization methods.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
EssentialpatcherFabric |
Low | Local file access | disableEssentialAutoUpdate(String mcVersion) uses the Java file API. Its name suggests it changes Essential’s automatic-update behavior. |
PatcherConfig |
Low | Reads and writes configuration; contains an external cosmetics URL | getConfigPath(), load(), and save() use local file APIs. Contains https://cosmetics.leclowndu93150.dev. |
CosmeticSaver |
Low | Saves and loads cosmetic outfits locally | savePath(), saveOutfit(...), and loadOutfit() use local file APIs. |
CosmeticHttpSync |
Moderate review item | Connects to the cosmetics service and syncs cosmetic data | Uses Java’s HTTP client in ensureAuthenticated(), joinSession(...), fetchAndApply(...), heartbeat(), pushCosmetics(...), and pushTrigger(...). |
CosmeticHttpSync |
Low | Computes a session identifier | computeSessionId(...) uses cryptographic APIs. The method name indicates session-ID generation, not credential theft. |
No bundled third-party library classes were identified as suspicious in this report. The flagged classes belong to the mod’s own com.leclowndu93150.essentialpatcher package.
Several reflection warnings occur in compatibility and mixin classes, which are part of the mod’s own integration code rather than separate shaded libraries:
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
compat.IrisCompat |
Low | Compatibility lookup using reflection | Reflection appears in the static initializer. Iris is a Minecraft shader mod, so compatibility code is plausible. |
compat.ShaderCompat |
Low | Finds shader-related functionality dynamically | findIsPackInUse() returns a reflected method. |
mixin.cosmetics.CosmeticsManagerMixin |
Low | Restores a cosmetic outfit through a mixin | essentialPatcher$restoreOutfit() triggered a reflection indicator. |
mixin.cosmetics.CosmeticsRenderStateLiveMixin |
Low | Detects a cosmetic item through compatibility code | Reflection is used in essentialPatcher$findAetherGlovesMethod(). |
mixin.cosmetics.InfraEquippedOutfitsMixin |
Low | Retrieves the player UUID from a cosmetics manager | essentialPatcher$getOwnUuid(...) triggered a reflection indicator. |
The report identifies one external destination:
https://cosmetics.leclowndu93150.devThe JAR uses Java’s HTTP client API in CosmeticHttpSync. The reported methods indicate the following network-related functions:
No additional domains, URLs, or IP addresses were reported. There is no reported downloader endpoint, command-and-control server, or unexplained collection endpoint.
Analysis coverage was complete for the reported JAR contents:
The scanner did not report obfuscation-like decompiler problems, malformed class files, or hidden archive content. Reflection and cryptographic API usage caused some review flags, but those flags are capability indicators—not proof that the code is concealed or malicious.
This is a Fabric Minecraft mod JAR. Its reported behavior fits its apparent purpose: patching or integrating with Essential-related cosmetic features, saving cosmetic selections, and synchronizing those cosmetics with a dedicated web service.
Fabric mods commonly use mixins and reflection because Minecraft internals and optional companion mods can vary between versions. The compatibility classes specifically mention Iris and shader/cosmetic-related methods, which supports a normal mod-compatibility explanation for the reflection warnings.
The main privacy consideration is the online cosmetics feature. If enabled, it contacts cosmetics.leclowndu93150.dev and appears to use a session tied to a UUID. That is expected for synchronized cosmetics, but it means the feature is not fully offline.
PatcherConfig reads and writes a local config file.CosmeticSaver saves and restores cosmetic outfit data.computeSessionId, which is consistent with generating or deriving a session identifier.disableEssentialAutoUpdate(...) appears to affect Essential’s automatic-update behavior, which is aligned with the mod’s stated patching role.No major malware-style red flags were reported.
The only meaningful area requiring user awareness is the external cosmetics service. The mod can authenticate to, exchange data with, and periodically contact cosmetics.leclowndu93150.dev. This is understandable for synchronized cosmetics, but users who do not want any third-party cosmetic syncing or UUID-associated online activity should avoid enabling that feature or should investigate the service’s privacy policy.
9a91584436839b83f627fca9339920bbc8ba19b7a3caa7b187fb1c9099960094.Static JAR scanning reduces risk by inspecting code structure, embedded URLs, API usage, and decompiled methods, but it cannot prove a file is completely safe. It cannot fully show what a remote server returns, whether a service changes behavior later, or every detail of data exchanged at runtime. A clean result also depends on the scanned JAR being the same file you install.
Yes. A JAR can contain malicious Java code, including code that steals data, downloads other files, runs commands, or communicates with an attacker-controlled server. This report did not detect those high-signal behaviors in this JAR.
Check its source, compare its checksum with an official release if available, inspect a JAR malware scanner report, and pay attention to unexplained networking, downloaders, command execution, persistence, and credential access. For this JAR, the scan successfully inspected all classes and identified one cosmetics-related service endpoint.
It can detect common RAT-related clues, such as remote command execution, process launching, persistence, suspicious download behavior, and unexplained outbound connections. This report does not contain those indicators. Static scanning cannot guarantee that any JAR is harmless in every runtime situation.
No. Some developers use obfuscation for size reduction, intellectual-property protection, or build tooling. It becomes more concerning when it prevents inspection alongside suspicious behavior. This JAR had no decompiler failures or anomaly warnings.
Verdict: Mostly trust
Risk level: Low to moderate
Confidence: High
Should I trust this JAR, and why? Mostly yes, provided it came from the intended developer or an official distribution source. All 44 classes were successfully inspected, and the flagged behavior matches a Fabric cosmetics/compatibility mod: configuration storage, saved outfits, compatibility reflection, and HTTPS cosmetic synchronization. The only external connection reported is cosmetics.leclowndu93150.dev, and the related methods are clearly named for authentication, sessions, syncing, and heartbeats. No evidence of credential theft, hidden downloading, remote command execution, destructive actions, persistence, or RAT-like behavior was found. Static analysis cannot guarantee complete safety, and users who dislike third-party cosmetic syncing should treat the online feature as the main trade-off.