[!WARNING] Final verdict available at the end of this report.
This Fabric mod JAR is very small: it contains 1 class with 11 methods. The scanner successfully parsed and decompiled that class, so the available code received full analysis coverage. No archive-entry tricks, parser failures, or decompiler anomalies were reported.
The scanner found three behavior categories in the mod’s only class, com.example.flowsmp.FlowsmpMod: outbound HTTP networking, file access, and process execution. The methods have notable names including fetchResource, runExe, and launchCompanion, so these signals need class-level context rather than being treated as ordinary library noise.
The scan found code in the mod’s own primary class that can:
ProcessBuilder.fetchResource, runExe, and launchCompanion.This combination is concerning because downloading a resource, saving it locally, and launching an executable are common parts of a downloader or installer pattern. The report does not provide the actual URL, destination path, executable name, or a confirmed call chain proving that fetchResource() directly feeds runExe(). However, the method names and capabilities are unusual for a simple Minecraft mod.
The scan did not report direct evidence of credential theft, token grabbing, browser-data theft, destructive file deletion, persistence mechanisms, or confirmed data exfiltration. That absence does not remove the concern around downloading and launching external programs.
The report does not show direct evidence of a remote-access trojan (RAT), such as a remote command listener, command-and-control server, persistent startup installation, or interactive remote-control features.
However, code that can download resources and execute external programs can be used as part of a malware delivery chain. The scan cannot confirm intent from these indicators alone, but this is not typical behavior to ignore in a Minecraft Fabric mod.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
com.example.flowsmp.FlowsmpMod |
High | Makes outbound HTTP requests | fetchResource(String url, Path dest) uses Java HTTP client APIs |
com.example.flowsmp.FlowsmpMod |
High | Writes or checks local files | launchCompanion(), isValidExe(Path file), runExe(Path target), and fetchResource(...) use Java NIO file APIs |
com.example.flowsmp.FlowsmpMod |
High | Starts an external executable/process | runExe(Path target) uses ProcessBuilder and contains a shell-related string indicator |
com.example.flowsmp.FlowsmpMod |
High | Appears designed to launch a companion program | Method named launchCompanion() |
All suspicious findings are in the JAR’s own mod class. There are no bundled third-party libraries in the report that explain these findings.
No bundled third-party library classes were reported. This means the networking, file access, and process-launch capabilities cannot be attributed to common shaded libraries such as bStats, HSQLDB, SLF4J, or Apache Commons.
The mod uses Java’s HTTP client API in:
fetchResource(String url, Path dest)No domain names, URLs, IP addresses, or request destinations were extracted by the scanner. Therefore, the report cannot determine whether the connection is to a legitimate update server, a mod-hosting service, or an unknown external source.
The method name suggests that the network request is intended to retrieve a resource and save it to a destination path. Because the same class also contains executable-launching code, the missing destination and URL details are important unresolved questions.
The JAR was fully covered by the scanner at the class level. There is no reported evidence of obfuscation, broken decompilation, or intentionally malformed code preventing inspection.
Because the JAR has only one class, the suspicious behavior is concentrated in its core implementation rather than being spread across large amounts of dependency code.
This is identified as a Fabric Minecraft mod. Minecraft mods may reasonably make web requests for update checks, APIs, player data, or online features. They may also read and write configuration files.
Starting an external executable is different. A typical Fabric mod normally runs inside Minecraft’s Java process and does not need to download and launch a separate .exe or companion application. If this behavior is expected, it should be clearly documented by the mod’s official publisher, including what is downloaded, where it comes from, and why it must run.
A few parts of the scan could be legitimate in another context:
However, this report does not identify a normal metrics library, update-check library, database library, or other bundled component that would explain the full combination of network downloading, executable validation, and process launching.
The major unresolved concern is the combination of these capabilities in the mod’s own code:
fetchResource that accepts a URL and destination file path.runExe that launches a target through ProcessBuilder.launchCompanion method suggesting that an external program may be started.There is no confirmed credential theft or RAT functionality in this report, but downloading and running an external executable is a significant red flag for a Minecraft mod unless the behavior is independently verified and expected.
fetchResource, runExe, and launchCompanion.Static JAR scanning reduces risk by identifying code capabilities, but it cannot prove a file is completely safe or malicious. This scan does not show the actual download URL, the file contents fetched at runtime, or whether the executable-launching methods are called during normal use.
A runtime sandbox analysis and review of the decompiled method bodies would be needed to confirm exactly what the mod downloads, where it saves it, and what it executes.
Yes. A JAR can contain Java code that downloads files, steals data, changes files, contacts remote servers, or launches other programs. A JAR is not automatically dangerous, but it should be treated like executable software.
Check where it came from, verify the publisher and file hash where possible, scan it with a JAR malware scanner and antivirus tools, and review suspicious behaviors. For this JAR, the important behaviors to investigate are the network download method and external executable launcher.
It can identify warning signs associated with RATs, including network access, process execution, suspicious file activity, remote-control APIs, and persistence patterns. This report does not show direct RAT-control or persistence evidence, but it does show a downloader-and-process-launch capability that warrants concern.
No. Developers sometimes obfuscate Java code to protect intellectual property or reduce copying. In this report, no decompiler anomalies or obfuscation indicators were detected. The concern comes from the observable functionality, not from obfuscation.
Verdict: Do not trust
Risk level: High
Confidence: Moderate
Should I trust this JAR, and why? No, not without strong independent verification from the original developer. The mod’s only class can make HTTP requests, write files, validate an executable, and launch an external process, with methods explicitly named fetchResource, runExe, and launchCompanion. Those behaviors are located in the mod’s own code rather than in a normal bundled library. The scan does not prove it steals data or acts as a RAT, and it does not reveal the download source, but a Minecraft Fabric mod that may download and run an external executable presents too much unresolved risk for normal use.