We found malware in 34 Minecraft projects that were still online

CurseForge and Modrinth

From 20 to 24 October 2026, we read the code of Modrinth and CurseForge files and found malware in 34 projects that were still online. We reported each one, and all 34 have been removed from the platforms where we found them.

What some of this malware did:

How we found them

Modgrade checks every file on Modrinth and CurseForge and decompiles the risky ones to read their code, which players never see. This reading follows fixed rules and runs on separate machines.

From 20 to 24 October 2026, we reported malware in 34 projects that were still online: 17 mods, 16 server plugins and one resource pack. Of these, 25 were on CurseForge and 9 on Modrinth. Many were not new: 23 of their 38 files had been online for more than four years, and the oldest, a resource pack, had been up since July 2015.

What the malware did

Eight mods stole your Minecraft session, which lets someone else play on your account without your password. Three of them also stole Discord tokens (the key that keeps you logged in to Discord), and two stole the passwords saved in your browser.

Eleven projects downloaded code from the internet and ran it when they started. All but one were server plugins; the other was a mod. That code is not in the file people download, so whoever controls the web address decides what it does. Three more plugins contained a fake copy of bStats, a common statistics tool, which loaded code from a look-alike address.

Five mods downloaded a program and ran it on the player's computer. Two projects set up a program or a script that starts each time you log in to your computer. The resource pack hid its program behind a texture file name.

One plugin let a stranger run commands on the server through the chat. Another ran a hidden cryptocurrency miner. Two sent the player's or the server's IP address to a Discord server. Both hid it in their code: one encoded the address of the service it asked for the IP, the other placed the code in a bundled library. The last one, a mod, had code that collects launcher accounts, but we found nothing that runs it.

What happened next

We reported each project to the platform where it was published: 15 on 20 October, one on 22 October and 18 on 24 October. By 24 October, all 34 had been removed from the platforms where we found them, and we posted about them on r/feedthebeast. The next day, CurseForge wrote in that thread that it had removed the projects we reported and banned their authors (source ). Modrinth removed its 9 projects between 20 and 24 October.

If you installed one of them

  1. Remove the file from your mods folder, or from the plugins folder of your server.
  2. Run a full scan with your antivirus.
  3. If the project stole sessions or passwords, use "sign out everywhere" in your Microsoft and Discord security settings, and change your Microsoft and Discord passwords, as well as the passwords saved in your browser.

You can check your other files with the Scanner.

The projects

On CurseForge (25): Anti Hack for Updated Versions, AntiFreeCam, AntiNetherRoof+, AntiScammerGG - TESTING, Bedwars Minigame, Bepis, BestKitPvP, Better Horse Teleport, DASMTTIISE, DelexeHub, Dungeons Extras, EasyGuiShop, EffectArmorMod, EpicCraft III, Full Bright, HubParkour, Items+ Mod. POTATO LAUNCHER!!!, MoreArmor/Weapons, SCF (Slime Chunk Finder), Slimagar, Texture Diagnostics, The 'Juicy' Pack, TooManyTools, Trolling and Memery, Vanilla Evolution.

On Modrinth (9): BerryAntiCheat, End Control, FabZoom, PGCVisibility, PlayerLocation, Sheer Item Frames, SimpleHomePlugin, SimpleMute, Weaker Day Zombie.

Each project's page explains what its malware does and what you should do. The report dates are on Minecraft Malware Reports.

More