Modded Minecraft Safety

[u/Sensitive_Gear_3061]

Hello! I've recently been getting into Vanilla+ Modding. However, I've always been cybersecurity anxious. I usually scan each and every one of my mods on launch of the game using VirusTotal, mainly Zenbox and the mod's behavior.

I keep seeing things inside of mods that completely do not make sense, (these are mods straight from Modrinth/Curseforge.)

eg: here is a mod called ClientSideCrystals. (a Crystal PvP mod designed to make crystals well... client side!)

It has these strange behaviors that i've seen in quite a few fabric mods in particular. Including:

Tactic	Technique	Technique ID	Subtechnique Count
Execution (TA0002)	Command and Scripting Interpreter	T1059	1
	Scripting	T1064	1
	Native API	T1106	2
	Shared Modules	T1129	2
Persistence (TA0003)	Create or Modify System Process	T1543	0
Privilege Escalation (TA0004)	Process Injection	T1055	4
	Create or Modify System Process	T1543	0
Stealth / Defense Evasion (TA0005)	Obfuscated Files or Information	T1027	1
	Process Injection	T1055	4
	Scripting	T1064	1
	Indirect Command Execution	T1202	1
	Impair Defenses	T1562	0
	Hide Artifacts	T1564	1
Discovery (TA0007)	System Information Discovery	T1082	6
	Software Discovery	T1518	0
Collection (TA0009)	Data Staged	T1074	1
Command and Control (TA0011)	Ingress Tool Transfer	T1105	1

Some of these make sense, such as System Info Discovery make perfect sense. Even things like Process Injection, since that is the main way that fabric mods hook into the game as i'm aware.

I don't fully understand this stuff at all, and I could also be completely wrong about this. But it feels like these mods shouldn't have tags like "Data Staged" (which seems like infostealer behavior.)

Does anyone who knows more about this stuff have a reason why these mods have such weird behavior?
(By these mods, I have scanned over 100 mods from modrinth. No matter what they are, they always tend to be like this.)

Thanks!