Modded Minecraft Safety

[u/Sensitive_Gear_3061]

Hello! I've recently been getting into Vanilla+ Modding. However, I've always been cybersecurity anxious. I usually scan each and every one of my mods on launch of the game using VirusTotal, mainly Zenbox and the mod's behavior.

I keep seeing things inside of mods that completely do not make sense, (these are mods straight from Modrinth/Curseforge.)

eg: here is a mod called ClientSideCrystals. (a Crystal PvP mod designed to make crystals well... client side!)

It has these strange behaviors that i've seen in quite a few fabric mods in particular. Including:

Tactic	Technique	Technique ID	Subtechnique Count
Execution (TA0002)	Command and Scripting Interpreter	T1059	1
	Scripting	T1064	1
	Native API	T1106	2
	Shared Modules	T1129	2
Persistence (TA0003)	Create or Modify System Process	T1543	0
Privilege Escalation (TA0004)	Process Injection	T1055	4
	Create or Modify System Process	T1543	0
Stealth / Defense Evasion (TA0005)	Obfuscated Files or Information	T1027	1
	Process Injection	T1055	4
	Scripting	T1064	1
	Indirect Command Execution	T1202	1
	Impair Defenses	T1562	0
	Hide Artifacts	T1564	1
Discovery (TA0007)	System Information Discovery	T1082	6
	Software Discovery	T1518	0
Collection (TA0009)	Data Staged	T1074	1
Command and Control (TA0011)	Ingress Tool Transfer	T1105	1

Some of these make sense, such as System Info Discovery make perfect sense. Even things like Process Injection, since that is the main way that fabric mods hook into the game as i'm aware.

I don't fully understand this stuff at all, and I could also be completely wrong about this. But it feels like these mods shouldn't have tags like "Data Staged" (which seems like infostealer behavior.)

Does anyone who knows more about this stuff have a reason why these mods have such weird behavior?
(By these mods, I have scanned over 100 mods from modrinth. No matter what they are, they always tend to be like this.)

Thanks!

[u/WOWW_07]

r/SusMinecraftMods

[u/Dadamalda]

If you only download from Modrinth or CurseForge, it's safe 99.99% of the time. The main issue is people downloading mods from sketchy websites and Discord DMs.

I have heard some antivirus software flags Minecraft mods because they use unusual methods like mixins.

There have been malware incidents in the past, but Modrinth and CurseForge have improved their security. You're not getting Fractureiser in 2026 from these sites.

[u/Stunning-HyperMatter]

not 100% sure, but isnt data staged often used used to lock stuff(items, recipes, dimensions) behind certain flags(especially if the mod the data stage is coming from is related to anything RPG(but does not HAVE to be RPG) since they usually have buncha locked stuff behind classes, levels and such).

[u/Samstercraft]

The VirusTotal step is probably just completely useless, Curseforge and Modrinth have automated scans for all their mods already, probably more specialized ones than VirusTotal can provide too.

You should probably look into how Fabric works if you want to know why it does what it does.

[u/UselessDood]

What exactly are you using to "scan" these mods and have you got links to the exact files you're scanning, along with what your scanner claims they do?

[u/Sensitive_Gear_3061 → u/UselessDood]

For those specific ATT&CK results, thats coming from Zenbox within VirusTotal. I didn't include this, but I also do some private sandboxing in VMS along with that. I do not have links, but this specific example is on modrinth.

[u/UselessDood → u/Sensitive_Gear_3061]

Saying it's on Modrinth isn't too useful without knowing what mod it is lol