[!WARNING] Final verdict available at the end of this report.
The scan examined neoforge-21.11.45-installer.jar, a 4.2 MB NeoForge installer containing 322 Java classes. All 322 classes were parsed and decompiled successfully, with no parse failures. The scanner reported 82 suspicious classes, 33 archive entries containing external URLs, and one decompiler anomaly.
Most findings relate to normal installer functionality: downloading Minecraft and NeoForge files, reading and writing installation files, creating or modifying JAR archives, loading classes, and using reflection. Many of the 82 flagged classes belong to the bundled Gson JSON library, where reflection is a standard implementation technique. The one difficult-to-decompile class is part of the Forge installer code and uses complex file, class-loading, and network logic.
The external URLs point mainly to NeoForged, Minecraft, Maven, GitHub, Apache, Java, and related project resources. The evidence below distinguishes URLs stored in metadata or documentation from code that performs downloads, and separates expected installer behavior from stronger malware indicators.
net.minecraftforge.installer.actions.PostProcessors trigger a decompiler warning?No high-signal malicious behavior was detected in the supplied report.
The scan does not identify credential theft, Minecraft or Discord token grabbing, hidden persistence, destructive commands, process execution, remote command execution, or obvious data exfiltration. It does identify code that downloads files and writes them to disk, but those operations are central to installing NeoForge, Minecraft libraries, mappings, and server components.
The report includes a scanner category called network_http_upload_combo in two places. However, the supplied evidence does not show an upload destination, stolen data, or a method that collects and transmits credentials. In context, the flagged methods are download and connection-wrapper code.
The evidence is not consistent with a remote-access trojan. No remote shell, command execution, persistence mechanism, credential or token collection, or covert remote-control protocol is reported.
The installer does connect to servers and can download installation components. That is expected for an installer and is not, by itself, RAT behavior.
The flagged installer classes are mainly under net.minecraftforge.installer. Their behaviors match an installer that downloads dependencies, validates files, accesses the Minecraft directory, extracts archives, and builds an installed server or client profile.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
net.minecraftforge.installer.DownloadUtils |
Medium scanner flag | Retrieves the Mojang version manifest, checks SHA-1 hashes, downloads mirrors, and extracts files | piston-meta.mojang.com, URL connection APIs, file APIs |
net.minecraftforge.installer.Downloader |
Medium scanner flag | Opens download streams and saves downloaded files | URL connection and file APIs |
net.minecraftforge.installer.actions.FatInstallerAction |
Medium scanner flag | Downloads files and writes them into a JAR/archive | NeoForge and GitHub URLs, archive packaging APIs |
net.minecraftforge.installer.actions.ServerInstall |
Medium scanner flag | Obtains the NeoForge server starter JAR | github.com/NeoForged/serverstarterjar/.../server.jar |
net.minecraftforge.installer.actions.ClientInstall |
Low-to-medium scanner flag | Installs client files and updates an installation profile | File and archive operations |
net.minecraftforge.installer.actions.PostProcessors |
Review flag | Uses complex file, reflection, class-loader, and URL-related logic | One decompile timeout; no direct malicious behavior shown |
net.minecraftforge.installer.SimpleInstaller |
Low-to-medium scanner flag | Locates the Minecraft directory and writes installer logs | Standard installer file operations |
net.minecraftforge.installer.json.* |
Low-to-medium scanner flag | Reads installation metadata and resolves artifact paths | Gson, reflection, URL, and file operations |
A large portion of the suspicious-class count comes from bundled libraries rather than custom NeoForge installer logic.
| Class or group | Severity | Behavior | Evidence |
|---|---|---|---|
com.google.gson.* |
Low scanner flag | Converts JSON data and uses reflection to inspect Java objects | Approximately 40 flagged Gson classes; reflection is normal for Gson |
com.google.gson.internal.TroubleshootingGuide |
Low scanner flag | Contains a link to Gson documentation on GitHub | Hardcoded documentation URL only |
com.google.gson.internal.bind.TypeAdapters$21 |
Low scanner flag | Handles JSON values representing Java URL objects |
URL API use while parsing data; no unexplained connection shown |
joptsimple.internal.* |
Low scanner flag | Uses reflection for command-line option conversion | Standard JOpt Simple utility behavior |
net.minecraftforge.installer.HashFunction |
Low scanner flag | Computes message digests such as SHA-1 for file verification | Crypto API used for download integrity checks |
The report does not identify suspicious custom package names, a hidden payload, or an unusual library used to conceal malicious behavior.
The JAR contains URLs associated with:
maven.neoforged.net — downloading NeoForge and related dependencies.libraries.minecraft.net — downloading Minecraft and supporting libraries.piston-meta.mojang.com — retrieving the Minecraft version manifest.mirrors.neoforged.net — selecting or using NeoForge download mirrors.github.com/NeoForged/serverstarterjar — obtaining the server starter JAR.github.com, Maven, Apache, Java, and project websites — dependency metadata, licenses, documentation, or project references.The most significant runtime-looking network behavior is in:
DownloadUtilsDownloaderFatInstallerActionServerInstallUtilProgressCallbackThese classes perform or support downloads that are expected from a NeoForge installer. The report does not show connections to an unknown IP address, a suspicious domain, a paste site, a command-and-control server, or an unexplained telemetry endpoint.
The 33 archive entries flagged for URLs are mostly Maven POM files, XML localization resources, and installer metadata such as version.json and install_profile.json. URLs inside these resources are not necessarily contacted merely because they are present in the archive.
The only anomaly was:
net.minecraftforge.installer.actions.PostProcessors.process(...)
The decompiler stopped before fully decompiling this method because of a complexity safeguard involving a long method, many exception handlers, and many branches. This is a review limitation, not proof of obfuscation or malware. The class uses reflection, class loading, file access, and URL-related APIs, which are plausible for an installer that discovers and processes libraries.
Overall, the scan achieved complete class parsing and attempted decompilation across the JAR. One complex method remains less readable than the rest.
This is a NeoForge Minecraft installer, not an ordinary gameplay mod. It is designed to:
Those capabilities are powerful because an installer changes files and downloads executable Java components. They are also the expected capabilities for this particular artifact.
Use the official NeoForge distribution source when possible, and compare the JAR’s SHA-256 hash with a trusted published hash if one is available.
PostProcessors class in an installer, where class loading and reflection can be legitimate.No major malware red flags are shown in this report.
The main unresolved item is the one complex PostProcessors method that was not fully decompiled. It deserves attention because it combines file access, class loading, reflection, and URL-related APIs. However, it is part of the expected installer package, and the scan provides no evidence that it executes malicious commands, steals credentials, establishes persistence, or contacts an attacker-controlled service.
The installer’s ability to download and place JAR files means that using an untrusted or tampered copy would still be risky, even though this scan does not show malicious behavior.
Static JAR scanning examines the contents and detectable code patterns but does not prove that a file is completely safe. It may miss behavior constructed dynamically at runtime, behavior triggered only under particular conditions, or malicious code inside a downloaded component. This report also does not verify the JAR’s digital signature, compare it with an official release, or analyze the files that the installer downloads later.
Yes. A JAR can contain arbitrary Java code, including malware. In this report, the detected download and file-writing behavior is consistent with NeoForge installation, and no high-signal malicious behavior was reported.
Use a JAR malware scanner, obtain the file from the official project source, compare its cryptographic hash with a trusted release hash, and review its permissions and runtime network behavior. For installers, also consider what files they are designed to download.
It can identify many common RAT indicators, such as command execution, suspicious networking, persistence, and credential theft. No such indicators are reported here, but static scanning cannot guarantee that every possible RAT technique would be detected.
No. Obfuscation can protect intellectual property or make reverse engineering harder. This report found only one complexity-related decompiler fallback, which is not sufficient evidence of malicious obfuscation.
Verdict: Mostly trust
Risk level: Low, with expected installer-level file and download access
Confidence: Moderate-high
Should I trust this JAR, and why? The scan covers all 322 classes and found no high-signal evidence of credential theft, persistence, destructive commands, remote control, or data exfiltration. The suspicious findings are largely explained by bundled Gson and JOpt Simple libraries plus normal NeoForge installer behavior such as downloading dependencies, checking hashes, and writing files. One complex installer method could not be fully decompiled, so the scan cannot prove complete safety. Trust it when obtained from an official NeoForge source or when its hash matches a trusted release; avoid an unofficial copy that cannot be verified.