Is ItemsAdder_4.0.16.jar Safe? JAR Virus and Malware Scan Report

[!WARNING]
Final verdict available at the end of this report.

What This JAR Scanner Found

The static analysis examined 1 651 classes (all successfully decompiled) and identified 223 classes with at least one “suspicious” indicator, which is about 13 % of the total.
Most of the flags relate to:

• Outbound connections – many hard‑coded URLs pointing to the plugin author’s domain (a.devs.beer, itemsadder.devs.beer), to a metrics service (pstats.devs.beer), and to public Maven repositories.
• File‑system access – reading/writing files, creating ZIP archives, and enumerating directories. This is typical for a plugin that loads custom assets, configuration files and language packs.
• Reflection / class‑loader usage – the plugin bundles a library loader (the “Libby” system) that dynamically loads other JARs at runtime. This triggers many “hard‑to‑review” warnings.
• Process execution – a single use of ProcessBuilder to run FFmpeg binaries that the plugin downloads on demand.

No evidence was found of credential theft, hidden payload download, or remote command execution beyond the explicitly listed URLs. The majority of the suspicious signals come from the plugin’s own core code and from the bundled library‑loading component, not from unknown malicious code.

Questions the Full Report Answers

• Does the JAR try to contact external servers? Yes, but only to the developer’s own sites, a metrics endpoint, and standard Maven repositories for library updates.
• Are the risky behaviours located in the plugin’s own code or in third‑party libraries? Both, but the most complex behaviours (reflection, class‑loader tricks) belong to the bundled “Libby” library, which is intentionally designed to load other JARs.
• Is there any sign of a remote‑access trojan or data exfiltration? No clear indicators of RAT‑style command‑and‑control or secret data leakage were detected.
• How much of the code could be inspected? 100 % of classes were decompiled with no parsing failures or decompiler anomalies.

Malware and Virus Findings

No high‑signal malicious behavior was detected.
The scanner did not find patterns typical of credential stealing, hidden downloads, destructive file deletion, or system‑wide process spawning. The only process execution observed is the legitimate unpacking of FFmpeg binaries that the plugin needs for video/audio handling.

RAT Detection

The evidence does not match a Remote‑Access Trojan. There is no persistent back‑door, no arbitrary command execution, and no stealthy network channel beyond the declared URLs.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
dev.lone.itemsadder.Main	Medium	Reads config files, contacts a.devs.beer for update/info URLs, opens HTTP connections.	file_access_api, hardcoded_external_url, outbound_connection_api
dev.lone.itemsadder.m.d	Medium	Downloads FFmpeg binaries from GitHub, runs them via ProcessBuilder.	process_execution_api, file_access_api, hardcoded_external_url
dev.lone.itemsadder.m.atu	Low	Sends a request to lobfile.com (privacy‑policy / upload API).	hardcoded_external_url, outbound_connection_api
dev.lone.itemsadder.m.aty	Low	Sends a request to a.devs.beer for host‑pack info.	hardcoded_external_url, outbound_connection_api
dev.lone.itemsadder.m.n (various a* classes)	Low‑Medium	Loads language files, reads/writes local files, enumerates directories.	file_access_api, filesystem_enumeration_api

(Only a representative subset is shown; many other core classes have similar file‑access or URL‑access flags.)

Bundled Third‑Party Libraries

Class	Severity	Behavior	Evidence
ia.sh.com.alessiodp.libby.LibraryManager	Medium	Dynamically downloads libraries from Maven Central, JCenter, JitPack, etc.; uses reflection and custom class‑loaders.	outbound_connection_api, file_access_api, hard_to_review_code_api
ia.sh.com.alessiodp.libby.classloader.IsolatedClassLoader	Low	Loads classes from downloaded JARs at runtime.	classloader_api, outbound_connection_api
me.libs.serverlibs.ServiceSupport	Medium	Resolves library sources, decodes Base64 configs, injects into the plugin via reflection.	hard_to_review_code_api, outbound_connection_api, file_access_api

These libraries are purpose‑built for runtime dependency management and are common in many Minecraft plugins.

Network Activity

Domain / Host	Purpose
a.devs.beer	Author’s website – update guides, download links, usage instructions.
itemsadder.devs.beer	Same author, specific plugin‑usage page.
pstats.devs.beer	Metrics / statistics service (usage reporting).
github.com	Hosts FFmpeg asset ZIP files and source repositories for bundled libraries.
repo1.maven.org, oss.sonatype.org, jcenter.bintray.com, jitpack.io	Standard Maven repositories for library dependencies.
maven-central.storage-download.googleapis.com, maven.aliyun.com	Mirrors for Maven Central.
lobfile.com	Optional upload / privacy‑policy endpoint used by a helper class.
api.mineskin.org	Skin‑lookup API (optional cosmetic feature).
hub.spigotmc.org	Documentation links for Bukkit/Spigot API classes.
minesk.in	Short‑link used in a command‑completion hint.

All outbound connections are hard‑coded and point to publicly reachable URLs owned by the plugin author or well‑known third‑party services.

Deobfuscation and Analysis Coverage

• Classes parsed: 1 651 / 1 651 (100 %).
• Decompile failures: 0.
• Decompiler anomalies: None detected.
• Obfuscation indicators: Only a few uses of Base64 encoding (for internal config strings) and heavy reflection, which are intentional for the dynamic loader, not evidence of malicious packing.

Is This Minecraft Mod Safe?

Yes, the file is a Minecraft server plugin (Bukkit/Spigot/Paper) named ItemsAdder. It follows the typical pattern of plugins that:

• Load custom assets (models, textures, sounds).
• Download helper binaries (FFmpeg) when needed.
• Report usage statistics to a developer‑hosted endpoint.

What Looks Normal

• Metrics / telemetry to pstats.devs.beer – a common practice for plugin authors to collect usage data.
• Update checks and documentation links to a.devs.beer and itemsadder.devs.beer.
• Dynamic library loading via the “Libby” system – many plugins shade a small loader to fetch optional dependencies at runtime.
• File handling for language packs (lang/*.yml) and custom asset ZIPs.
• Downloading FFmpeg from the plugin’s GitHub releases – required for video/audio features.

What Is Dangerous

• No evidence of credential theft, hidden payloads, or remote command execution beyond the explicitly listed URLs.
• The only potentially concerning pattern is the extensive use of reflection and custom class‑loaders, which makes static analysis harder, but these are part of the bundled library manager and are not inherently malicious.
• All hard‑coded URLs point to domains owned by the plugin author or reputable services; there are no unknown or suspicious domains.

What Should You Do?

1. Update to the latest version (if a newer release exists) to benefit from any security patches.
2. Review the URLs (e.g., a.devs.beer) in a browser if you want to verify the content they serve.
3. Consider firewall rules that allow outbound HTTP/HTTPS only to the listed domains, if you run a highly locked‑down server.
4. Monitor the plugin’s logs for any unexpected errors or failed downloads.

Scan Limitations

Static scanning can spot many risky patterns, but it cannot guarantee that runtime behaviour is safe. The plugin could, for example, change its network targets after installation or load additional code from the downloaded libraries. Dynamic analysis (running the plugin in a sandbox) would provide extra confidence.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A JAR is just a ZIP archive of Java bytecode, and it can execute arbitrary code when loaded by a Java application.

How do I check whether a JAR file is safe?

Use a combination of static analysis (like the report above), dynamic sandbox testing, and reputation checks (e.g., community reviews, official plugin repositories).

Can this scanner detect a Minecraft RAT?

It can flag typical RAT behaviours (remote command execution, hidden network channels, credential stealing). In this case, no RAT‑like indicators were found.

Does obfuscation mean a JAR is malicious?

Not necessarily. Many legitimate plugins obfuscate or heavily use reflection for compatibility or to load optional dependencies. Obfuscation only raises the difficulty of analysis; it isn’t proof of malware.

Final JAR Safety Verdict

Verdict: Mostly trust
Risk level: Low‑to‑Medium
Confidence: High (full decompilation, no hidden malicious patterns)

Should I trust this JAR, and why?
The scan shows that ItemsAdder 4.0.16.jar performs only the expected actions for a feature‑rich Minecraft plugin: loading assets, checking for updates, reporting usage statistics, and downloading helper binaries from the author’s own servers. All outbound connections are to known, developer‑controlled domains or public Maven repositories. There is no evidence of credential theft, hidden payloads, or remote‑control capabilities. While the heavy use of reflection and dynamic class loading makes the code harder to read, these techniques are part of a legitimate library‑loader component. Therefore, the plugin can be used safely on a server, provided you keep it up‑to‑date and are comfortable with its telemetry endpoints.