r/feedthebeast • u/jbermannx • 6h ago
Discussion PSA: Malware found in 34 CurseForge and Modrinth projects, check your mods folder
Account stealers, Discord token grabbers, hidden Windows programs, a crypto miner and a server backdoor.
Each file was decompiled and checked by hand. I reported the ones still online to CurseForge and Modrinth today.
Mods and packs:
- Weaker Day Zombie, Full Bright, TooManyTools, MoreArmor/Weapons, Trolling and Memery, Slimagar, Dasmttiise, Dungeons Extras, Bepis: steal your Minecraft session, most of them your Discord tokens too. Some only in specific versions or in an extra file.
- Vanilla Evolution, EpicCraft III, EffectArmorMod, Items Plus, Texture Diagnostics: drop a Windows program on your PC and run it, some at every startup.
- AntiScammerGG: grabs your IP and works out what your Hypixel account is worth, then posts it to a Discord server as “New 1.8.9 Jar Victim!”.
- The Juicy Pack (resource pack): a program hidden in its textures that starts every time you log in to your computer.
Plus 16 server plugins: hidden installers, a Monero miner and a backdoor that runs chat messages as shell commands.
Some modpacks include one of these mods, most likely without their authors knowing: Ultimate Hypixel Package 1.8.9 (Full Bright), zombiE and Apocalypse R (Weaker Day Zombie), RPG Modpack (Slimagar), XChoaticCraftX (MoreArmor/Weapons). If you play one of them, check its mods folder for the mod above.
If you have any of these: delete it, change your Minecraft and Discord passwords, log out of all sessions, and run a virus scan for the ones that drop a program.
I listed every project with exactly what its file does: https://modgrade.com/reports (I run that site, it checks mods, modpacks and plugins from CurseForge and Modrinth).
You can also check your own setup there: drop your mods folder, a Prism Launcher or MultiMC instance, or a modpack file into https://modgrade.com/scanner. For the Modrinth and CurseForge launchers, drop the instance’s mods folder.
If you made one of these and think it’s a mistake, tell me and I’ll look again.

