[!WARNING] Final verdict available at the end of this report.
The scanner examined 1 355 classes (all of them successfully de‑compiled) and looked at 9 465 methods and 5 650 fields. It flagged 76 classes (about 5 % of the total) as “suspicious” because they use APIs that can read/write files, open network connections, or perform reflection. Most of those flags come from the core functionality of the Meteor client – things like saving settings, checking for updates, logging into Microsoft accounts, and communicating with official Minecraft services.
A single decompiler anomaly was reported in the AutoArmor class, caused by a stack‑underflow during de‑compilation; this is a harmless parsing issue, not evidence of malicious code. The scan also noted the use of reflection, class‑loader tricks, native library loading, and Base64 handling, which are common in complex Minecraft mods.
Overall, the scanner did not find any concrete evidence of credential theft, hidden downloads, destructive commands, or remote‑access trojan (RAT) behavior.
No high‑signal malicious behavior was detected. The scanner did not see any code that reads saved passwords, writes malicious files, or exfiltrates data to unknown locations. All outbound URLs point to known services (e.g., meteorclient.com, github.com, Microsoft/Xbox Live login endpoints, Mojang APIs).
The evidence does not match a remote‑access trojan. The only command‑execution indicator is a method that opens a URL (likely launching the user’s web browser), which is typical for “login‑via‑browser” flows.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
meteordevelopment.meteorclient.Main |
Low | Reads local files, contacts meteorclient.com for installation FAQ |
file‑api, hard‑coded URL |
meteordevelopment.meteorclient.Main$OperatingSystem |
Low | Opens a URL, may invoke the OS default browser | runtime_exec_api, java_net_url_api |
meteordevelopment.meteorclient.systems.accounts.MicrosoftLogin |
Medium | Performs OAuth flow with Microsoft/Xbox Live, contacts several login servers, uses localhost redirect | many hard‑coded URLs, socket to 127.0.0.1 |
meteordevelopment.meteorclient.systems.modules.misc.SwarmConnection / SwarmHost / SwarmWorker |
Low‑Medium | Opens raw sockets to user‑specified IP/port (used for “swarm” feature) | socket_api |
meteordevelopment.meteorclient.utils.ReflectInit |
Low | Uses reflection to load classes at runtime | reflection_api |
meteordevelopment.meteorclient.utils.network.Http |
Low | Sends HTTP requests via Java’s HTTP client | java_http_client_api |
meteordevelopment.meteorclient.utils.render.PlayerHeadUtils |
Low | Calls Mojang’s session server to fetch skin URLs (Base64‑encoded) | base64_api, hard‑coded URL |
The report did not list any separate third‑party libraries that triggered additional warnings. All flagged behavior originates from the Meteor client’s own packages.
https://meteorclient.com, https://github.com/MeteorDevelopment/meteor-client, https://fabricmc.net – used for update checks, documentation, and Discord link. login.live.com, user.auth.xboxlive.com, xsts.auth.xboxlive.com, api.minecraftservices.com, plus a localhost redirect (http://127.0.0.1:9675). api.mojang.com, sessionserver.mojang.com, sessionserver.thealtening.com, authserver.thealtening.com. https://meteorclient.com/api/capeowners, https://meteorclient.com/api/capes. All outbound connections are to well‑known domains required for the client’s features (authentication, updates, skin fetching, etc.).
AutoArmor) needed a fallback due to a stack‑underflow, which is a harmless parsing glitch. Yes, the file is a Minecraft client mod (Fabric‑compatible) known as Meteor Client. It provides a large set of cheat‑like features for the game and therefore needs to read/write configuration files, communicate with authentication servers, and sometimes open sockets for its “swarm” feature.
open(URL) method, which simply launches the default browser. Static analysis can spot known risky patterns but cannot guarantee that runtime behavior is harmless. It also cannot detect malicious code that is hidden behind encrypted strings or that only activates under very specific conditions not visible in the bytecode.
Yes, a JAR is just a ZIP of Java bytecode, so it can contain malicious code that runs when the JAR is executed.
Use a reputable static scanner (like the one that produced this report), verify the publisher’s reputation, compare checksums with official releases, and, if possible, run the JAR in a sandbox or monitor its network/file activity.
The scanner can flag behaviors typical of a RAT (e.g., hidden downloads, credential stealing, remote command execution). In this report, none of those high‑signal indicators were found.
Not necessarily. Many legitimate developers obfuscate code to protect intellectual property. However, heavy obfuscation can make analysis harder and is a factor to consider when assessing risk.
Verdict: Mostly trust
Risk level: Low‑Medium
Confidence: High
Should I trust this JAR, and why?
The Meteor client JAR contains many legitimate file‑system and network operations that are required for its advertised features (settings storage, update checks, Microsoft login, skin fetching). All outbound URLs point to known, public services, and there is no evidence of hidden downloads, credential theft, or destructive commands. The few “hard‑to‑review” signals (reflection, native loading) are typical for complex Minecraft mods and do not, on their own, indicate malicious intent. Therefore, you can generally trust this JAR, especially if you obtain it from the official GitHub release, but you may want to disable optional networking features (e.g., Swarm) if you prefer an extra layer of caution.