[!WARNING] Final verdict available at the end of this report.
The scan inspected all 116 classes in opsec-26.2_v1.1.7.1.jar. All classes were parsed and decompiled successfully, with no parse failures or decompilation failures. One class produced a minor decompiler anomaly involving a stack-underflow fallback while reading JSON configuration.
The scanner identified 18 classes with indicators involving file access, network access, reflection, class loading, or hardcoded URLs. The reported destinations are mainly official Minecraft/Microsoft authentication services, GitHub, and Modrinth. The JAR also contains one metadata entry with links to the project’s Modrinth page, GitHub repository, and issue tracker.
These signals need class-level context. File and network access are normal for a Minecraft mod that manages accounts, checks updates, inspects installed mods, handles downloaded resource packs, or communicates with Minecraft services. The evidence below separates those expected behaviors from issues that would be more concerning.
No high-signal malicious behavior was detected in the supplied report.
The report does not identify indicators for:
However, the mod does contain account-related code that communicates with Microsoft, Xbox Live, and Minecraft authentication services. That is sensitive functionality, even when the destinations are legitimate. The scan alone does not prove how every authentication value is handled at runtime.
The evidence is not consistent with a remote-access trojan. No remote shell, arbitrary command execution, persistence, process execution, or connection to a suspicious control server is reported.
The presence of sockets and HTTP APIs appears associated with Minecraft networking, resource-pack handling, account authentication, and update checks rather than remote control.
All listed suspicious classes belong to the mod’s own aurick.opsec.mod package. The scanner’s flags are mainly generic API indicators rather than findings of malicious intent.
| Class | Severity | Behavior | Evidence |
|---|---|---|---|
aurick.opsec.mod.accounts.SessionAccount |
Sensitive but explainable | Microsoft/Xbox Live and Minecraft account authentication | Contacts official authentication endpoints including login.live.com, user.auth.xboxlive.com, xsts.auth.xboxlive.com, and api.minecraftservices.com |
aurick.opsec.mod.accounts.AccountManager |
Low | Loads and saves account-related data | Uses Java file APIs in load() and save() |
aurick.opsec.mod.config.JarIntegrityChecker |
Low | Checks release information | Requests a GitHub API release tag |
aurick.opsec.mod.config.UpdateChecker |
Low | Checks for updates and links to releases | Contacts GitHub release/API URLs |
aurick.opsec.mod.OpsecClient |
Low | Scans installed mod and shader locations | Uses Java file APIs in language-file and shader scanning methods |
aurick.opsec.mod.protection.ResourcePackGuard |
Low to moderate | Clears resource-pack-related caches | Enumerates and removes files from cache folders |
aurick.opsec.mod.mixin.client.HttpUtilMixin |
Moderate but expected in context | Hooks HTTP file downloading | Uses URL connections, sockets, and network APIs while handling downloads |
aurick.opsec.mod.mixin.client.ClientConnectionMixin |
Moderate | Hooks client network behavior | Uses sockets and reflection |
aurick.opsec.mod.mixin.client.DownloadQueueMixin |
Low | Isolates downloaded pack paths | Uses file paths while handling downloaded resources |
aurick.opsec.mod.mixin.client.DownloadedPackSourceMixin |
Low | Wraps downloaded resource-pack files | Uses Java file APIs |
aurick.opsec.mod.tracking.ModIdResolver |
Moderate | Identifies loaded mods and code locations | Uses file APIs and reflection |
aurick.opsec.mod.tracking.ModRegistry |
Moderate | Inspects mod containers, shader data, and known hooks | Uses file APIs, reflection, and class-loader APIs |
aurick.opsec.mod.detection.TrackPackDetector |
Moderate but unclear | Analyzes patterns related to resource packs | Uses a URL API in analyzePatterns(); the report does not show the destination |
aurick.opsec.mod.mixin.MeteorMixinCanceller |
Low | Reads a setting related to Meteor compatibility | Uses file APIs |
aurick.opsec.mod.config.OpsecConfig |
Low | Loads and saves configuration | Uses Java file APIs |
aurick.opsec.mod.config.OpsecConstants$AuthUrls |
Sensitive but explainable | Stores authentication service URLs | Contains official Microsoft, Xbox Live, and Minecraft endpoints |
aurick.opsec.mod.mixin.client.ClientLanguageMixin |
Low to moderate | Reads mod information from resource packs | Uses reflection to inspect pack resources |
The most security-sensitive area is SessionAccount, because it implements an account authentication flow. The destinations are official services rather than an unknown collection server, and the report does not show those values being sent elsewhere. Nevertheless, users should treat any mod that handles account sessions as more sensitive than a purely cosmetic mod.
The report does not identify suspicious classes from the commonly bundled libraries listed in the scan guidance. The 18 flagged classes are all under the mod’s own aurick.opsec.mod namespace.
The report lists these network destinations:
api.minecraftservices.comlogin.live.comuser.auth.xboxlive.comxsts.auth.xboxlive.comauth.xboxlive.comhttp:// URL rather than HTTPSapi.github.comgithub.commodrinth.comfabric.mod.jsonThe Minecraft and Microsoft endpoints are consistent with account login or session validation. GitHub requests are consistent with integrity or update checks. The fabric.mod.json URLs are ordinary project metadata links.
One detail deserves attention: the report records http://auth.xboxlive.com in addition to HTTPS endpoints. The scan does not establish whether this URL is actually used, whether it is redirected, or whether it is a harmless legacy constant. It is worth verifying in the source or at runtime because authentication-related traffic should use HTTPS.
The only anomaly is in:
aurick.opsec.mod.config.SpoofSettings.fromJson(JsonObject json)
The decompiler encountered a stack-underflow condition while processing a putfield instruction and used a fallback. This is a small, isolated analysis issue and is not, by itself, evidence of malicious obfuscation.
The report does not show heavy obfuscation or broad analysis failure. Static scanning still cannot reveal every runtime decision, especially when behavior depends on configuration, server responses, reflection, or dynamically loaded code.
This is a Fabric Minecraft mod, based on the presence of fabric.mod.json and the aurick.opsec.mod package.
Its apparent functions include:
Those functions explain most of the scanner’s network and filesystem indicators. The account-management feature remains the most sensitive part because it interacts with authentication tokens or session information.
Several findings are consistent with ordinary Minecraft mod behavior:
The suspicious classes are in the mod’s own code, but their names and methods largely match the stated functionality of a protection, tracking, account, or resource-pack-management mod. They are not suspicious merely because they use files or networks.
No major malware indicators are shown in the report.
The remaining concerns are:
TrackPackDetector.analyzePatterns() uses a URL API, but the destination is not shown in the class-level evidence.auth.xboxlive.com appears once with http:// rather than HTTPS; this should be checked.a80439fa80edc18c317faf44e8f0d54fef2196a97cca713287fe633a17779a1.This is a static and decompiler-based scan. It can identify API usage, hardcoded URLs, suspicious structures, and some malware patterns, but it cannot prove that a JAR is completely safe.
Static analysis may miss behavior that is generated dynamically, activated only under specific conditions, hidden behind reflection, or delivered by a compromised dependency or server. A clean report also does not establish that the downloaded file came from the genuine project. Source review, trusted distribution, hash verification, and runtime monitoring provide additional protection.
Yes. A JAR can contain Java code that steals data, downloads malware, executes commands, or modifies files. This report does not show high-signal virus-like behavior, but no static scan can prove complete safety.
Use a reputable scanner, inspect the source or decompiled code, download it from an official release page, verify its hash, and monitor its network and file activity. Pay special attention to credential handling and unknown outbound destinations.
It can detect some common RAT indicators, such as command execution, suspicious network endpoints, persistence, and process launching. It cannot guarantee detection of a carefully hidden or runtime-only RAT. This report does not show evidence consistent with a Minecraft RAT.
No. Obfuscation can be used for intellectual-property protection or to make reverse engineering harder. This report found one isolated decompiler anomaly, not broad obfuscation or widespread analysis failure.
Verdict: Mostly trust
Risk level: Moderate, mainly because the mod handles account authentication
Confidence: Moderate
Should I trust this JAR, and why? The scan successfully inspected all 116 classes and found no high-signal evidence of credential theft, hidden malware downloads, destructive behavior, persistence, remote control, or obvious data exfiltration. Its network activity is mostly directed to official Minecraft, Microsoft, Xbox Live, GitHub, and Modrinth services, which fits the apparent purpose of the mod. The main caution is that the mod handles sensitive account-session operations, and one Xbox-related URL is recorded as HTTP rather than HTTPS. I would use it only from the official project source, verify the file hash when possible, and avoid using it with a valuable account until its authentication behavior is independently verified.