Why it matters
Modgrade checks every file on Modrinth and CurseForge and decompiles the risky ones to read their code, which players never see.
1. We find some malware while it is still online
Our October 2026 report: We found malware in 34 Minecraft projects that were still online.
2. A removed mod is still on players' computers
When a platform removes a project, it does not remove the copies people already downloaded. The files stay in their mods folders, and the platform has no way to warn them, because only the launcher or the player can see what is installed.
In late October 2026, the researcher Haxy found six Modrinth mods whose update carried a hidden download that installs a browser extension. The extension records the passwords you type. Modrinth removed the mods. Players who had installed them still had the files. Six Minecraft mods on Modrinth carried a hidden download that installs a password-stealing browser extension
3. What you can do
- Players: drop your mods folder in the Scanner. It tells you if any of your files is on our list, even if the project has been removed.
- Launchers and tools: a launcher or tool could look up a file in the API by its fingerprint (SHA-1, a code that identifies one exact file) or by project. The API keeps answering "malware" after a removal, so the launcher could warn the players who still have the file.
- Journalists: every project we list, with its dates and who found it, is on Minecraft Malware Reports.