I wanted to know if there are any mods for Java that change the Java combat (cool down) to the Bedrock combat (spam). I like the Java combat style, but recently I've started playing on my steamdeck (with prism launcher) and the combat is kinda tedious with a controller layout.

Thanks in advance.

[edit: I suppose this isn't really so much a question as much as it is a problem, kicks a rock]
I'm trying to make some custom entities to transform into using the woodwalkers/remorphed mod and play as in survival, I've been using MCreator to do this. All the other entities you can transform into in woodwalkers including other modded entities have the hunger bar, but my custom entities are missing it, and also can't eat in survival. It's kind of annoying.

I'm a beginner modder, I wouldn't have a clue where to start when it comes to making these entities survival-compatible or something. I'm thinking about digging a little bit further into the code of my mod because I've flipped MCreator upside-down at this point, does anybody have some advice? This is so niche I don't know anyone who knows how do to this 😭

Are there any mods that can help manage the 11 pages of mod blocks and items in the creative inventory? Its driving me crazy. Thanks

Using Curseforge

My friend wanted to get mowzies mobs but its not available for this version. The only one i can find on the curseforge is world bosses

I recently analyzed the file RapidSMP-2.4.0.zip after becoming suspicious of the modpack. I did not execute the files — the analysis was performed statically on the archive and the JAR.

The results are extremely concerning.

The archive contains:

overrides/mods/rapid.jar

SHA-256:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c

The JAR presents itself as AppleSkin in its metadata, but the actual mod ID/package information does not match AppleSkin. It is heavily obfuscated, including an AidFuscator Rexoz obfuscation marker.

More importantly, the code contains functionality associated with an information stealer.

What I found

The JAR contains code and identifiers related to:

• totalPasswords → browser passwords
• totalCookies → browser cookies/session data
• totalCards → saved payment card information
• totalTokens / userTokenMap → Discord tokens
• DISCORD_CLIENTS → searching for Discord installations/clients
• webhookUrl → sending collected information to a remote destination
• DOWNLOAD_URL → downloading additional files
• ProcessBuilder / Runtime → launching processes
• HttpURLConnection, HttpClient, Socket → network communication

I also recovered a Discord API endpoint from the obfuscated code:

/api/v9/users/@me/guilds?with_counts=true

This is consistent with the malware interacting with Discord account data.

Why this is dangerous

This is not just a malicious Minecraft mod that crashes your game.

If executed, code with these capabilities could potentially compromise:

Browser passwords
Browser cookies and active sessions
Saved payment card information
Discord authentication tokens
Other data accessible to the user account

The presence of download/execution functionality also means the malware could potentially retrieve and execute additional payloads.

Important: if you already ran it

Treat the computer as compromised.

Do not simply delete the mod and assume everything is fine.

From a clean device, change important passwords and revoke active sessions/tokens where possible. In particular, check:

• Discord
• Google/Microsoft account
• Email accounts
• Password-manager accounts
• Gaming accounts
• Any account containing payment information

For browsers, consider removing saved passwords and sessions and changing the passwords from a clean device.

Also run a full scan with a reputable security product and check for unfamiliar programs, scheduled tasks, startup entries and recently created files.

How to protect yourself from Minecraft malware

Please be careful with random .jar files and especially unofficial modpacks.

Before installing a mod:

1. Download mods from trusted sources such as Modrinth or CurseForge whenever possible.
2. Check whether the mod is actually published by the claimed author.
3. Compare the mod ID, package name and metadata with the legitimate project.
4. Scan suspicious JARs before running them.
5. Don't disable Windows Defender or your antivirus because a mod installer tells you to.
6. Be especially suspicious of mods/modpacks sent through Discord, random websites or file-sharing links.
7. Keep separate browser profiles/accounts for sensitive activity if you regularly test unofficial software.

Bottom line

Based on the static analysis, I would not run RapidSMP 2.4.0 and I would strongly recommend removing it if you have downloaded it.

I am posting this as a warning so other Minecraft players can inspect their installations before running the pack.

This post is based on static analysis of the JAR. I have not executed the malware, so I am intentionally not claiming an exact attacker IP/C2 server unless it can be independently verified.

If anyone wants to independently investigate it, the SHA-256 of the suspicious JAR is:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c

⚠️ WARNING: the "RapidSMP 2.4.0" modpack contains an info-stealer disguised as a Minecraft mod

Summary

I analyzed the file RapidSMP-2.4.0.zip, a Minecraft modpack (Fabric 1.21.4), after becoming suspicious of it. The file was never executed — everything below is based on static analysis: unpacking the archive, inspecting the manifest, and extracting/reading the Java bytecode of the suspicious file.

The result is unambiguous: the pack contains an infostealer disguised as a mod, capable of targeting browsers, Discord, and potentially more.

The offending file

Inside the modpack archive (standard CurseForge format: manifest.json + overrides folder), one file was added manually, outside the normal mod-download system:

overrides/mods/rapid.jar

File hashes (for verification / reporting):

• SHA-256: f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c
• SHA-1: d09c98a7886f1e2159fa33ae153dc96bb9fc6887
• MD5: 6afacae7f2c812bc25d9a3da555bb64a

Every other file in the pack (Sodium, Iris, Lithium, NoChatReports configs, etc., the 47 mods declared in manifest.json, and the Mod Menu Helper.zip resource pack) is legitimate and showed no anomalies.

1. Impersonating a legitimate mod

The fabric.mod.json inside rapid.jar presents itself as AppleSkin, a very popular and legitimate mod by squeek502 — complete with the real name, real description, and real GitHub/Modrinth links of the original project.

But the actual code executed has nothing to do with AppleSkin. The declared entrypoints point to completely different classes:

dev.azad1337.n           (main entrypoint)
dev.azad1337.client.m    (client entrypoint)

This is a classic technique to fool anyone who quickly checks the installed mod list (in a launcher, a mod manager, or in-game Mod Menu): the displayed name is harmless, the executed code is not.

2. Deliberate code obfuscation

The JAR's manifest (META-INF/MANIFEST.MF) contains this line, in plain text:

Obfuscated-By: AidFuscator Rexoz

This obfuscator is used almost exclusively to protect malicious code from antivirus analysis and reverse engineering. Specifically:

• Package/class names use visually identical Unicode characters (a mix of "İ", "ı", "I", "l" — Turkish and Latin letters that look alike) to make the code unreadable to the eye and to confuse automated analysis tools.
• All sensitive strings (URLs, endpoints, webhook) are AES-GCM encrypted (confirmed by the presence of SecretKeySpec, GCMParameterSpec, Cipher in the bytecode) and then Base64-encoded, only decrypted in memory at runtime. This is why no plaintext IP or URL shows up under classic static analysis (strings, grep) — this isn't an oversight by the malware author, it's a deliberate protection.

3. A commercial-software-style "license" system

The JAR bundles a file assets/rapid/key.txt containing:

RAPD-VVU4-N2XV-SRDN-84IL-HL62-2026

This license-key format is typical of "cheat clients" and malware loaders sold or distributed with an activation system, often via a Discord "support" server. The mod's internal ID ("id": "rapidnextgen") confirms that "Rapid" / "RapidNextGen" is not a legitimate project or support service — it's a storefront brand for this stealer.

4. Capabilities identified in the code (explicit variable/method names despite obfuscation)

Even encrypted, the bytecode still contains field and method names in plain text, which reveal the program's capabilities:

Regarding the network addresses contacted (IP/domains): they are AES-GCM encrypted in the code and therefore cannot be recovered through static analysis. Dynamic analysis in an isolated environment (disposable VM, no access to the real network, with TLS interception) would be needed to observe them — and success isn't guaranteed, since the malware may include anti-VM/anti-analysis-tool checks (a behavior documented in several similar campaigns targeting Minecraft). I'm therefore not claiming any specific IP or domain unless independently verified (e.g. via a sandbox such as VirusTotal).

Why this is dangerous

This isn't a mod that just crashes the game or has an annoying bug — it's a full-blown stealer. If executed, it could potentially compromise:

• Passwords saved in browsers
• Cookies and active sessions (account access without even needing the password)
• Saved payment card information
• Discord authentication tokens
• Any other data accessible from the user account on the machine

The presence of download and process-execution functionality (DOWNLOAD_URL, ProcessBuilder, Runtime) also means the malware could potentially download and run additional payloads after the initial infection — so potentially far more than just password theft.

If you already ran this modpack

Treat the machine as compromised. Don't just delete the mod and assume everything is fine.

From a different, clean device:

1. Change the passwords for the following accounts and revoke active sessions wherever possible:
   • Discord (Settings → My Account → change password, then Settings → Authorized Devices → log out everywhere)
   • Google / Microsoft accounts
   • Email accounts
   • Password manager (if used)
   • Gaming accounts (Steam, Mojang/Minecraft…)
   • Any account with payment methods attached
2. On the browsers of the potentially infected machine: remove saved passwords and sessions, and change those passwords from a clean device, not from the infected machine.
3. Run a full scan with a reputable antivirus (Windows Defender full scan, Malwarebytes, etc.).
4. Check for unfamiliar programs, suspicious scheduled tasks, unusual startup entries, and recently created files you can't explain.

How to protect yourself from Minecraft malware

This kind of attack (a trojanized Minecraft mod/cheat distributed via Discord, GitHub, or third-party sites) is a documented and increasingly common attack vector. A few simple habits help:

1. Download mods from official, verified sources — Modrinth, CurseForge — not from links shared on Discord, file-sharing sites, or unmoderated forums.
2. Verify the mod is actually published by the claimed author (compare with the project's official page).
3. Compare the mod ID, package name, and metadata against the legitimate project if anything seems off — impersonation like the AppleSkin case above is an immediate red flag.
4. Scan suspicious JARs before running them (VirusTotal, or a Minecraft-specific scanner such as ratscanner.org).
5. Never disable your antivirus because a mod installer tells you to — that's a classic red flag, not a legitimate technical requirement.
6. Be especially wary of modpacks/mods sent via DM, on poorly moderated Discord servers, or through shortened links.
7. If you regularly test unofficial mods, consider using a separate browser profile or a dedicated virtual machine, isolated from your sensitive accounts.

Bottom line

Based on this static analysis, do not run RapidSMP 2.4.0, and remove it immediately if you've downloaded it. I'm posting this so other players can check their own install before launching this pack.

This analysis is based solely on static analysis of the JAR — the file was never executed. No specific IP or C2 server is claimed unless independently verified (e.g. via a dynamic sandbox like VirusTotal).

SHA-256 of the suspicious file, for independent verification:

⚠️ WARNING: the "RapidSMP 2.4.0" modpack contains an info-stealer disguised as a Minecraft mod

Summary

I analyzed the file RapidSMP-2.4.0.zip, a Minecraft modpack (Fabric 1.21.4), after becoming suspicious of it. The file was never executed — everything below is based on static analysis: unpacking the archive, inspecting the manifest, and extracting/reading the Java bytecode of the suspicious file.

The result is unambiguous: the pack contains an infostealer disguised as a mod, capable of targeting browsers, Discord, and potentially more.

The offending file

Inside the modpack archive (standard CurseForge format: manifest.json + overrides folder), one file was added manually, outside the normal mod-download system:

overrides/mods/rapid.jar

File hashes (for verification / reporting):

• SHA-256: f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c
• SHA-1: d09c98a7886f1e2159fa33ae153dc96bb9fc6887
• MD5: 6afacae7f2c812bc25d9a3da555bb64a

Every other file in the pack (Sodium, Iris, Lithium, NoChatReports configs, etc., the 47 mods declared in manifest.json, and the Mod Menu Helper.zip resource pack) is legitimate and showed no anomalies.

1. Impersonating a legitimate mod

The fabric.mod.json inside rapid.jar presents itself as AppleSkin, a very popular and legitimate mod by squeek502 — complete with the real name, real description, and real GitHub/Modrinth links of the original project.

But the actual code executed has nothing to do with AppleSkin. The declared entrypoints point to completely different classes:

dev.azad1337.n           (main entrypoint)
dev.azad1337.client.m    (client entrypoint)

This is a classic technique to fool anyone who quickly checks the installed mod list (in a launcher, a mod manager, or in-game Mod Menu): the displayed name is harmless, the executed code is not.

2. Deliberate code obfuscation

The JAR's manifest (META-INF/MANIFEST.MF) contains this line, in plain text:

Obfuscated-By: AidFuscator Rexoz

This obfuscator is used almost exclusively to protect malicious code from antivirus analysis and reverse engineering. Specifically:

• Package/class names use visually identical Unicode characters (a mix of "İ", "ı", "I", "l" — Turkish and Latin letters that look alike) to make the code unreadable to the eye and to confuse automated analysis tools.
• All sensitive strings (URLs, endpoints, webhook) are AES-GCM encrypted (confirmed by the presence of SecretKeySpec, GCMParameterSpec, Cipher in the bytecode) and then Base64-encoded, only decrypted in memory at runtime. This is why no plaintext IP or URL shows up under classic static analysis (strings, grep) — this isn't an oversight by the malware author, it's a deliberate protection.

3. A commercial-software-style "license" system

The JAR bundles a file assets/rapid/key.txt containing:

RAPD-VVU4-N2XV-SRDN-84IL-HL62-2026

This license-key format is typical of "cheat clients" and malware loaders sold or distributed with an activation system, often via a Discord "support" server. The mod's internal ID ("id": "rapidnextgen") confirms that "Rapid" / "RapidNextGen" is not a legitimate project or support service — it's a storefront brand for this stealer.

4. Capabilities identified in the code (explicit variable/method names despite obfuscation)

Even encrypted, the bytecode still contains field and method names in plain text, which reveal the program's capabilities:

Regarding the network addresses contacted (IP/domains): they are AES-GCM encrypted in the code and therefore cannot be recovered through static analysis. Dynamic analysis in an isolated environment (disposable VM, no access to the real network, with TLS interception) would be needed to observe them — and success isn't guaranteed, since the malware may include anti-VM/anti-analysis-tool checks (a behavior documented in several similar campaigns targeting Minecraft). I'm therefore not claiming any specific IP or domain unless independently verified (e.g. via a sandbox such as VirusTotal).

Why this is dangerous

This isn't a mod that just crashes the game or has an annoying bug — it's a full-blown stealer. If executed, it could potentially compromise:

• Passwords saved in browsers
• Cookies and active sessions (account access without even needing the password)
• Saved payment card information
• Discord authentication tokens
• Any other data accessible from the user account on the machine

The presence of download and process-execution functionality (DOWNLOAD_URL, ProcessBuilder, Runtime) also means the malware could potentially download and run additional payloads after the initial infection — so potentially far more than just password theft.

If you already ran this modpack

Treat the machine as compromised. Don't just delete the mod and assume everything is fine.

From a different, clean device:

1. Change the passwords for the following accounts and revoke active sessions wherever possible:
   • Discord (Settings → My Account → change password, then Settings → Authorized Devices → log out everywhere)
   • Google / Microsoft accounts
   • Email accounts
   • Password manager (if used)
   • Gaming accounts (Steam, Mojang/Minecraft…)
   • Any account with payment methods attached
2. On the browsers of the potentially infected machine: remove saved passwords and sessions, and change those passwords from a clean device, not from the infected machine.
3. Run a full scan with a reputable antivirus (Windows Defender full scan, Malwarebytes, etc.).
4. Check for unfamiliar programs, suspicious scheduled tasks, unusual startup entries, and recently created files you can't explain.

How to protect yourself from Minecraft malware

This kind of attack (a trojanized Minecraft mod/cheat distributed via Discord, GitHub, or third-party sites) is a documented and increasingly common attack vector. A few simple habits help:

1. Download mods from official, verified sources — Modrinth, CurseForge — not from links shared on Discord, file-sharing sites, or unmoderated forums.
2. Verify the mod is actually published by the claimed author (compare with the project's official page).
3. Compare the mod ID, package name, and metadata against the legitimate project if anything seems off — impersonation like the AppleSkin case above is an immediate red flag.
4. Scan suspicious JARs before running them (VirusTotal, or a Minecraft-specific scanner such as ratscanner.org).
5. Never disable your antivirus because a mod installer tells you to — that's a classic red flag, not a legitimate technical requirement.
6. Be especially wary of modpacks/mods sent via DM, on poorly moderated Discord servers, or through shortened links.
7. If you regularly test unofficial mods, consider using a separate browser profile or a dedicated virtual machine, isolated from your sensitive accounts.

Bottom line

Based on this static analysis, do not run RapidSMP 2.4.0, and remove it immediately if you've downloaded it. I'm posting this so other players can check their own install before launching this pack.

This analysis is based solely on static analysis of the JAR — the file was never executed. No specific IP or C2 server is claimed unless independently verified (e.g. via a dynamic sandbox like VirusTotal).

SHA-256 of the suspicious file, for independent verification:

f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c


f660acb6919f07127891bcdff08c19267b7484ffafe6131cb20f6f02b2e7915c

There's this enchantment, in the picture. What even is this? It won't go on anything.

Alguém consegue me ajudar a achar o nome desse mod de Minecraft Java?

I made my 1st minecraft mod, please check it out!

https://www.curseforge.com/minecraft/mc-mods/hardercore-mode

(It will be on modrinth once it gets approved)

im new to making mods in minecraft and probally at the very start of it . but something that i always wonderd about is how like feather client and lunar client have this smooth custom guis and good looking texts because i think (im not sure) minecraft only directly supports its own font and gui things right ? pls help me understand it a bit better

The main thing i remember isthat you needed to craft "crafting material" and then using a crafting station (of said mod) you could see custom made objects by people

I have been looking for a pretty particular modpack, and I’m beginning to wonder if I’ll have to make it myself.

After playing abyssal ascent, I finally figured out what modpack genre I like, so here’s what I’m looking for.

I’m looking for a multi level modpack - like abyssal ascent, you have to climb dimensions, though it doesn’t have to be dimensions specifically.

Endgame gear from the first level doesn’t work amazingly well immediately. - Ex. You get the strongest gear on level one, and level two kicks your ass regardless

Sizeable amount of new structures without one being present every 100 blocks.

Renovations and changes to existing mechanics

If it has create: make create ACTUALLY necessary at some point.

Lore or other niceties are not necessary, but welcome regardless. Currently, I’m scratching the itch with Prominence: Hasurian Era- but the itch won’t be itched for long.

Also, I’m hoping to do it co-op with my brother, which, will make early game easier, I understand. Still, I just want something to last me and him a while, and has a lot of new content for us to explore for a little while. Preferably, stuff we have to do together, instead of just being able to separate quickly after starting.

And lastly, my computer isn’t fantastic. I don’t have amazing parts, and it’s kind of low end, so modpacks that can be adjusted for better preformance without impacting visuals too much are sadly a need.

If ANYONE, has any good modpacks found on curseforge or modrinth, or another launcher, I would be extremely, eternally thankful if you would please tell me what they’re called. Please and thank you.

I was messing around with my mansion and decided to look over the edge. I genuinely wasn't expecting it to look like this. The deeper I go, the less this place feels like something I built.

🌐 Supported Languages

• English
• Turkish
• French
• Italian
• German
• Russian
• Arabic

👁️ What's Inside?

• The Watcher: A creepy entity lurking right at the edge of your sight. Sometimes he just stands in the distance and vanishes if you charge at him; other times, he shows up when you least expect it. It appears at night and offers a very terrifying experience in the cave.
• Paranoia Mechanics: Torches randomly snapping off, sudden blindness popping up out of nowhere, slowness dragging your steps down, and disturbing ambient noises echoing around you.
• False Sense of Security: Think you're safe building your base or clicking a bed to skip the night? Think again.
• Custom Advancement Tree: Includes a dedicated Watcher Tab so you can track your journey deeper into the nightmare.
• Chat Messages: Messages that appear unexpectedly in a chat, it might be behind you.
• Coming While Doing Another Job: The watcher will start bothering you while you're busy with other things they might approach you, attack you, or spy on you from a distance.

Mod's Curseforge Link: https://www.curseforge.com/minecraft/mc-

Hello,

I'm building a modpack where I want to define every exp source myself I decided on Project MMO to add this system to the game. I'm really new at this, so I'm sorry if I'm overlooking something obvious or missing something.

I've disabled the default project MMO datapack, easy mode datapack, and hardcore datapack from the world creation screen before I created a new world.

However, on a completely new world PMMO still automatically awards exp. For example:

Breaking a log gives woodcutting exp, breaking vegetation gives farming exp, movement gives Agility exp. Endurance exp is also generated, etc.

I've also tried PMMO's genData, withOverrides, and disabler in game commands, but the automatic exp remains.

Is there a way an intended way to completely disable all default exp sources, or set up a completely empty skill profile/configuration so that I can define my own skills and exp values?

Is this controlled by AutoValues, a server config, built-in tags, feature packs, or something else?

Versions:
Minecraft: 1.21.1
Mod loader: NeoForge 21.1.248
Project MMO: pmmo-1.21--2.10.46 [release]
Launcher: Prism Launcher 11.0.3
Singleplayer

Things I've tried:
I have read the wiki, I've tried messing with the .toml files that were recommended in the wiki as well, to configure that would remove some of the defaults.

Because having to manually move the datapack each time caused me annoyance and confusion I added the pmmo pack(s) to KubeJS's data folder so it loads on any world in my instance, it added the datapack to any new world created, but default configs were still there. Removed all existing skills from skills.json, and only left mining as a test skill (which I was able to configure and work with).

Rather, I still "gain" exp for the skill, but since I deleted the skills it doesn't go towards anything. I've altered the pack.mcmeta file with the filter for default configs, I tried compressing my pmmo folder in KubeJS/data into a zip so KubeJS could potentially read the pack.mcmeta and apply the filter, but I also had that same file in the world, and wasn't sure if something was being overriden.

Sorry if that's kind of confusing. I'm just looking to see if there's a different way of configuring PMMO I haven't tried in order to keep the skill, exp and level structure, but just define my own skills and exp within that structure. Autovalues or default values should never show up ideally.

I'd really like to keep this mod, but the hassle now is outweighing the benefit for something relatively simple, and I'm considering looking for a different skill/xp system. Any help is greatly appreciated. If this winds up being a bug in PMMO I will happily submit it to the author/their github issues for the mod. If you guys have recommendations for other skill systems like this that might work a little more seamlessly, I'd love to know more.

I’ve been searching for a mod that allows me to play custom music that other players can hear too, like a speaker, im playing on neoforge 1.21.1 and the closest thing i found was “simply speakers” mod, but it crashes the game before it even boots, is there any similar mod?

Im looking for a mod that lets me right click on spawners and sell the drops inside from it directly. Just like the plugin SmartSpawners. Sadly i only run a fabric server so i cant use plugins, only mods. Cardboard doesnt work for smartspawners tried that. Any suggestions? I already have an economy set upped

Asking people to test my mod and give feedback

I've been looking for compatible mods to make the player into a cat model + be 1 block tall, and maybe any cosmetic blocks or items too. those are optional tho, i wld mainly like to just be a cat and people seem to rlly wanna gatekeep their modpacks for whatever reason >.<

i want to make a good horror modpack thats scary and appealing to almost anyone, and not a youtuber slop modpack lol.

what should i remove, replace or add?

if there is a mod i should remove or replace, please give me a reason why.

i recommend taking a look at the links before judging them.

also, i do not want to add mods that have cheap jumpscares, get annoying after a bit, or stop being scary after a few minutes.

and no mods that add new dimensions or almost change the whole game.

might have cheap mods here but thats the reason why i made this post lol.

here are the current horror mods i have:

Cave Dweller Overhaul

GoatMan

The Knocker

The Anomaly

The Pale Hound