Is meteor-client-1.21.11-local.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This scan inspected a 4.8 MB JAR containing 1,358 classes and 9,483 methods. All 1,358 classes parsed and decompiled successfully, giving the scan very broad code coverage. The scanner marked 76 classes (about 5.6%) for review, mostly because they read or write files, make network requests, inspect folders, or use reflection.

The most relevant areas for closer inspection are the mod’s account-login code, network utilities, proxy and socket features, a “Swarm” networking feature, native-library loading, and one method that can open a URL using the operating system. Most of the detected URLs point to Meteor Client, GitHub, Fabric, Microsoft/Xbox/Minecraft authentication services, Mojang, or The Altening.

A scanner flag does not automatically mean malware. File access is expected for a configurable Minecraft client, and Microsoft/Mojang network requests are expected for account login and profile lookups. The class-level evidence matters because it shows whether these capabilities are tied to visible features or hidden, unexplained behavior.

Questions the Full Report Answers

• Are the JAR’s network connections mainly related to Minecraft login, profiles, and Meteor Client features?
• Does the operating-system command capability run arbitrary commands, or does it appear to open web links?
• Are file reads and folder scans consistent with profiles, macros, songs, fonts, logs, and settings?
• Is there evidence of RAT-like remote control, credential theft, hidden downloading, or persistence?
• How much of the JAR was successfully inspected, and was it heavily obfuscated?

Malware and Virus Findings

No high-signal malicious behavior was detected. The report does not show evidence of credential-stealing routines, clipboard token grabbers, hidden payload downloads, ransomware-like file destruction, startup persistence, or deliberate data exfiltration in the inspected code.

However, this mod includes account-login functionality that handles Microsoft/Xbox authentication and refresh-token flows. That is a sensitive capability by nature: it is expected for an account manager, but users should only enter account credentials into a copy obtained from a source they trust.

The scan also found network-capable proxy and socket code. Those capabilities can be legitimate for the mod’s advertised features, but they deserve extra care because the report does not fully establish every runtime destination or use case.

RAT Detection

The evidence is not consistent with a typical remote-access trojan (RAT). There is no detected hidden command-and-control domain, arbitrary remote shell execution, persistence mechanism, concealed downloader, or obvious remote-command handler.

One process-execution indicator exists in Main$OperatingSystem.open(URL). Its method name and URL parameter strongly suggest it is used to open a link in the user’s normal browser or operating system, rather than execute attacker-provided system commands. Static scanning cannot completely rule out misuse through another code path, but this specific finding is not strong RAT evidence.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
meteordevelopment.meteorclient.Main$OperatingSystem	Low–Medium	Opens a supplied URL using operating-system functionality	runtime_exec_api in open(URL); also uses Java URL APIs
meteordevelopment.meteorclient.systems.accounts.MicrosoftLogin	Medium	Microsoft/Xbox/Minecraft account login and refresh-token flow	Connects to login.live.com, Xbox Live, and api.minecraftservices.com; local callback at 127.0.0.1:9675
meteordevelopment.meteorclient.systems.accounts.types.TheAlteningAccount	Medium	Alternative account-service support	Connects to The Altening authentication and session servers over HTTP
meteordevelopment.meteorclient.systems.modules.misc.swarm.*	Medium	Direct socket networking between a host and workers	SwarmConnection, SwarmHost, and SwarmWorker use socket APIs; worker accepts an IP and port
meteordevelopment.meteorclient.systems.proxies.Proxy	Medium	Proxy networking	Uses raw socket communication in sendData
meteordevelopment.meteorclient.utils.network.Http	Low–Medium	General HTTP request helper	Java HTTP client API; no suspicious destination identified in this class
meteordevelopment.meteorclient.systems.Systems	Medium	Initializes core systems and loads a native library	Native-load API detected during init()
meteordevelopment.meteorclient.MixinPlugin	Low	Fabric/Mixin integration	Reflection and class-loader APIs in onLoad; normal for mod-loading/injection systems
meteordevelopment.meteorclient.utils.network.Capes	Low	Retrieves Meteor Client cape information	Requests meteorclient.com/api/capeowners and /api/capes
Profile, waypoint, song, font, log, and config classes	Low	Reads, writes, imports, exports, or lists user-selected game data	File and directory APIs tied to named features such as profiles, Notebot songs, fonts, packet logs, and waypoints

The majority of the 76 flagged classes are in the mod’s own meteordevelopment.meteorclient package, rather than clearly identified shaded third-party libraries. Most of those flags are file-access detections associated with understandable client features: saving settings, loading macros, importing/exporting profiles, recording songs, storing waypoints, handling fonts, and writing packet logs.

Bundled Third-Party Libraries

No distinct bundled third-party library group was identified in the supplied suspicious-class list. The report mainly identifies Meteor Client’s own package and Minecraft/Fabric-related integration code.

That does not mean the JAR contains no dependencies; it means this report’s flagged entries do not primarily point to common shaded libraries such as analytics, database, or logging packages.

Network Activity

The JAR contains the following identifiable network destinations:

• Meteor Client: meteorclient.com
  • Main website, installation FAQ, Discord link, cape-owner and cape data APIs.
• GitHub: github.com/MeteorDevelopment/meteor-client
  • Project, issues, and repository links.
• Fabric: fabricmc.net
  • Fabric mod metadata documentation URL.
• Microsoft/Xbox/Minecraft authentication:
  • login.live.com
  • user.auth.xboxlive.com
  • xsts.auth.xboxlive.com
  • api.minecraftservices.com
  • These are used by the MicrosoftLogin account-login flow.
• Mojang services:
  • api.mojang.com
  • sessionserver.mojang.com
  • Used for Minecraft player/profile lookups and skin/profile data.
• Local machine callback: 127.0.0.1:9675
  • Used as the local redirect address for the Microsoft OAuth login process. This is a common login pattern: a browser redirects back to a temporary listener on the same computer.
• The Altening:
  • sessionserver.thealtening.com
  • authserver.thealtening.com
  • These are alternative-account service endpoints. The report shows them using http://, not HTTPS, which is less secure than encrypted HTTPS communication.

The scanner also found generic Java URL, HTTP-client, and socket APIs. The socket features are associated with the mod’s proxy and Swarm components, which may connect to user-configured addresses rather than fixed domains visible in the JAR.

Deobfuscation and Analysis Coverage

• Classes found: 1,358
• Classes parsed: 1,358
• Classes failed to parse: 0
• Classes decompiled: 1,358
• Classes failed to decompile: 0
• Decompiler anomaly classes: 1 of 1,358 (about 0.07%)

The only decompiler anomaly was in:

• meteordevelopment.meteorclient.systems.modules.combat.AutoArmor
• Method: getScore(itemStack)
• Issue: a decompiler fallback caused by a stack-underflow reading problem.

This single issue is not meaningful evidence of obfuscation or malware. The scan successfully analyzed the rest of the JAR, so there is no broad decompilation failure or heavy anti-analysis pattern shown here.

The JAR does use reflection, class loading, Base64 handling, and native-library loading in several places. These features make some code harder to review automatically, but they are not proof of malicious intent—especially in a Fabric client mod that uses mixins, integrations, and platform-specific code.

Is This Minecraft Mod Safe?

This appears to be a Fabric Minecraft client mod, based on the included fabric.mod.json, Fabric-related classes, Mixin integration, and Minecraft/Mojang service usage.

Its detected file behavior is broadly compatible with a feature-rich Minecraft client: settings storage, profiles, macros, waypoints, song files, fonts, logs, cached data, and imported/exported configurations. Its Microsoft/Xbox/Minecraft network behavior is also consistent with an account manager and profile lookup features.

The important practical concern is provenance. The filename includes local, and the scan report alone cannot confirm that this exact JAR matches an official Meteor Client release. A legitimate-looking package name and legitimate URLs do not prove that a downloaded copy has not been modified.

What Looks Normal

• Fabric metadata and Mixin code: Reflection and class-loader use are commonly required for Minecraft mod injection and compatibility handling.
• Settings and profile files: The mod saves and loads configurations, themes, profiles, waypoints, macros, packet logs, and Notebot songs.
• Directory listing: Listing folders is expected when presenting song files, profiles, font directories, waypoint files, or other user-managed game data.
• Mojang and Minecraft APIs: Player-profile, skin, session, entitlement, and authentication requests are expected for account and player-information features.
• Microsoft OAuth callback: 127.0.0.1:9675 is a local callback endpoint used during browser-based account login, not an external server.
• Meteor Client and GitHub links: The hardcoded project, support, documentation, and cape API URLs are understandable.
• Opening a URL: The sole Runtime.exec-style finding is in a method named open(URL), which is consistent with launching a website in a browser.
• Base64 use: Base64 in NBT or player-skin/profile code is commonly used for encoded game data and does not by itself indicate concealed payloads.

What Is Dangerous

No major malware red flags were identified, but several capabilities remain security-sensitive:

• Account credentials and refresh tokens: The mod contains Microsoft/Xbox account-login code. Only use a copy from an official, verifiable source, and avoid entering credentials into an unverified or modified build.
• Proxy and Swarm socket functionality: These components can make direct network connections to configurable IP addresses and ports. The report does not provide full runtime context for how users configure or activate them.
• The Altening endpoints use HTTP: The identified The Altening authentication/session URLs are unencrypted http:// URLs. If you use that optional account service, understand that HTTP provides weaker transport security than HTTPS.
• Native-library loading: The JAR can load native code. The report does not identify the native library or prove misuse, but native code receives a higher level of access and is harder for a Java-only scan to inspect.
• Unknown build provenance: The report identifies the file as meteor-client-1.21.11-local.jar, not as a signed or verified official release. This is an unresolved supply-chain concern, not proof of malware.

What Should You Do?

• Download or compare the JAR against the official Meteor Client distribution source rather than trusting a reposted or “local” build.
• Verify the SHA-256 hash if the publisher provides an official checksum:
  0e2756ea4d3d6dc17f30bd22d12b0ded7d65f68a12a4b8a62e5460e9863842d2
• Do not enter Microsoft credentials unless you trust the file’s source and have verified it was not modified.
• Avoid enabling proxy, Swarm, or alternative-account features unless you understand why you need them.
• If possible, test unfamiliar mods in a separate Minecraft profile and use a non-primary account first.

Scan Limitations

A static JAR scan examines code and embedded strings without running the file. It can identify risky APIs, domains, and suspicious patterns, but it cannot prove that a JAR is completely safe or predict every behavior triggered by a particular server, configuration, downloaded add-on, or runtime environment.

This scan had excellent Java code coverage, but native code loaded at runtime, externally supplied configuration, user-selected proxy targets, and any dynamically obtained content may not be fully represented in the report.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code, including credential theft, file damage, hidden downloads, or remote-control functions. This report did not detect those high-signal behaviors in the inspected Java code, but that is not a guarantee that the file is virus-free.

How do I check whether a JAR file is safe?

Use a JAR malware scanner, inspect its source and download location, compare its checksum with an official release, and check whether its network and file behavior match its advertised features. For account-capable Minecraft mods, source verification matters especially because they can handle login tokens.

Can this scanner detect a Minecraft RAT?

It can detect common RAT-related evidence such as remote command execution, suspicious hidden network endpoints, persistence, downloader behavior, credential theft patterns, and anti-analysis techniques. This report does not show strong evidence of a Minecraft RAT.

Does obfuscation mean a JAR is malicious?

No. Some Java and Minecraft code decompiles imperfectly because of compiler output, mappings, optimizations, or compatibility code. Here, only one method had a decompiler issue, while all classes were otherwise parsed and decompiled successfully; that is not a meaningful obfuscation warning.

Final JAR Safety Verdict

Verdict: Use caution
Risk level: Moderate
Confidence: Moderate–High

Should I trust this JAR, and why? The inspected Java code does not show the usual signs of malware, such as hidden downloading, credential-stealing logic, persistence, destructive actions, or RAT-style remote control. Most flagged behavior fits a feature-rich Fabric client mod: configuration files, profiles, Notebot songs, fonts, Minecraft account login, Mojang profile requests, and Meteor Client web features. However, the JAR also includes sensitive account-token handling, raw socket/proxy and Swarm networking, native-library loading, and optional unencrypted The Altening endpoints. Because this is labeled as a local build and the report cannot verify its origin or whether it matches an official release, trust it only after verifying the download source and hash.