[!WARNING] Final verdict available at the end of this report.
This JAR scanner inspected all 598 classes in industrial-foregoing-1.20.1-3.5.22.jar, including 4,106 methods containing code. Every class was parsed and decompiled successfully, with no decompiler anomalies or failed classes reported.
The scan found two classes requiring review and one archive resource containing an external link. The main findings are an HTTPS request to GitHub's raw-content service for a contributors.json file, a Patreon link in the mod's included book data, and one use of Java reflection in the MobCrusherTile class.
These signals need context: external links and network APIs can be normal for mod information, update-related data, credits, or optional online features. Reflection means code dynamically accesses Java classes or methods, which can be legitimate in complex mod integrations but is harder for an automated scanner to interpret.
MobCrusherTile mean?No high-signal malicious behavior was detected.
The report does not show evidence of credential or token theft, hidden payload downloads, operating-system process execution, destructive file behavior, persistence mechanisms, remote command execution, or data exfiltration. The only identified network destination in executable code is a GitHub-hosted contributors.json file.
This does not prove the file is virus-free, but the scan did not identify the common behaviors expected from a malicious JAR.
The evidence is not consistent with a remote-access trojan (RAT).
There are no reported indicators of remote control, shell or command execution, hidden persistence, credential collection, or an unexplained command-and-control connection. The detected URL points to a public GitHub raw-content endpoint for a contributors list, rather than a private control server or downloaded executable payload.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
com.buuz135.industrial.IndustrialForegoing |
Low | Makes an HTTPS request to retrieve contributor data | Contains https://raw.githubusercontent.com/Buuz135/Industrial-Foregoing/master/contributors.json; flagged for a hardcoded external URL and Java network URL API use. |
com.buuz135.industrial.block.agriculturehusbandry.tile.MobCrusherTile |
Review needed | Uses Java reflection | Flagged because reflection can make automated review harder. The report does not identify malicious behavior, a network destination, or command execution in this class. |
data/industrialforegoing/patchouli_books/industrial_foregoing/book.json |
Informational | Contains a Patreon link in included documentation/book content | Contains https://www.patreon.com/buuz135. This is a link in resource data, not evidence that the JAR connects to Patreon automatically. |
No suspicious bundled third-party library classes were identified in this report. The reported findings are in the mod's own com.buuz135.industrial code and its included resource data.
The scan identified these external URLs:
https://raw.githubusercontent.com/Buuz135/Industrial-Foregoing/master/contributors.json
IndustrialForegoing class.https://www.patreon.com/buuz135
No other domains, IP addresses, download URLs, or unexplained outbound destinations were reported.
Analysis coverage was strong:
There are no reported signs of code obfuscation based on decompiler failures, malformed classes, default-package class dumping, or decompiler anomaly patterns. One class uses reflection, which is an area that merits manual context review, but reflection alone is not proof of obfuscation or malware.
This appears to be the Industrial Foregoing Minecraft mod JAR for version 1.20.1. Its detected behavior is consistent with a mod that includes in-game documentation, a project support link, and an optional online contributor-data lookup.
The scan did not find evidence that the mod downloads code, executes system commands, collects Minecraft credentials, or establishes remote control over the computer or server.
contributors.json file from the project’s GitHub repository is consistent with displaying contributor or credits information.No major red flags were found.
The one unresolved item is reflection in MobCrusherTile. Reflection can conceal exactly which methods or fields are used until runtime, so it receives an automated review flag. However, this report does not connect that reflection use to network access, command execution, credential access, persistence, or destructive actions.
9220ddde2c259c8dfa5c05ad23b26650dc9b2f3048c4aca3b1d9d6f4cd211f3d.Static JAR scanning examines the contents and code patterns of a file without running it. It is useful for finding known risky behavior such as suspicious network calls, embedded URLs, command execution, and hard-to-analyze code.
However, no static scan can prove a JAR is completely safe. Behavior can depend on configuration, other installed mods, server environment, or code paths that are not activated during analysis.
Yes. A Java JAR can contain malicious code, including credential stealers, downloaders, remote-control tools, or destructive behavior. This report did not detect those high-signal behaviors in this JAR.
Use a JAR malware scanner, verify the download source, compare hashes when available, review network destinations, and test the file in a separate environment. For this JAR, the scan fully parsed and decompiled all classes and identified only a GitHub contributor-data request, a Patreon documentation link, and one reflection use.
It can identify common RAT-related warning signs, including suspicious remote connections, command execution, persistence, credential theft, hidden downloads, and hard-to-review code. This report contains no evidence consistent with a Minecraft RAT.
No. Some legitimate Java software is obfuscated or difficult to decompile. In this case, there were no decompiler failures or anomaly indicators suggesting broad obfuscation. The report identified one reflection API use, which is not the same as malicious obfuscation.
Verdict: Mostly trust
Risk level: Low
Confidence: High
Should I trust this JAR, and why? Mostly yes: the scan successfully inspected all 598 classes and found no signs of credential theft, hidden downloads, remote control, destructive actions, or process execution. Its only identified outbound connection is to the project’s public GitHub contributors.json file, while the Patreon URL is contained in documentation data. One MobCrusherTile class uses reflection, which is harder to automatically inspect, but the report provides no evidence that it is used for harmful behavior. As with any mod, use a trusted download source and test it separately before installing it on an important server.