Are Minecraft mods safe to install and use

A mod file can run code on your computer, and no platform can promise every file is clean. The public record is the fractureiser malware of 2023, found in files on CurseForge and the BukkitDev plugin site, whose last stage tried to take browser logins, Discord credentials and Microsoft and Minecraft credentials. The team that handled the incident says prevention at platform scale is not feasible, because code can be laid out in endless ways to hide its purpose. Every Java mod page we list is gathered on Minecraft Java Mods.

We did not scan or test any file. This page reports what the platforms and the incident team publish about checks, and what has gone wrong in public. Facts were read on 14 October 2026.

What the platforms say they check

The pack holds no review policy written by CurseForge or Modrinth, so we cannot quote either one. For their own words, see our pages on CurseForge and Modrinth.

What we can attribute is second-hand. A Microsoft moderator, answering a reader question on Microsoft Q&A on 6 May 2025, says CurseForge runs virus scans on uploaded mods. The same answer adds that mods are written by third-party developers, so a small chance of malicious code always remains.

After the 2023 incident, the fractureiser team's guide says Modrinth scanned the previous 10 months of uploads and found no infected projects. The same guide calls that result luck, not proof of a better filter.

What has gone wrong

The one incident in the sources is fractureiser, named after the CurseForge uploader account that posted the most notable malicious files. The team's guide describes mod and plugin files that looked harmless, and a malware chain with a first stage hidden in the mod file and three further stages after it. Its final stage is said to attempt the following: spreading to every Java file on the machine, stealing browser cookies and logins, swapping cryptocurrency addresses on the clipboard, and stealing Discord, Microsoft and Minecraft credentials.

The repository states that the event has ended: no follow-up first stages were found and no activity appeared in the three months after. It also says a copycat is possible and likely inevitable, and that machines already infected remain a concern. The guide says macOS did not appear to be affected, the malware targeted Windows and Linux, and Bedrock Edition was not affected. Our own page covers the timeline and the cleanup: Is Fractureiser Still a Risk to Minecraft Mod Players.

What the checks do not cover

• Disguised code. The team says the code in the first stage was not necessarily suspicious to an automated system and could have been something another mod would use. Early detection rules flagged popular mods such as Quark by mistake.
• Platform scale. The team calls prevention at that scale not feasible, because code can be laid out in endless ways to hide its purpose.
• Hijacked creators. The malicious files reached users through other developers' copies of working projects, so a trusted-looking project page did not prove the file was untouched. The guide says individual users were hit, not CurseForge itself.
• Individual mods. The team says it could not confirm the safety of any named mod, and that a machine carrying the final stage would infect files that were clean when downloaded.
• Antivirus coverage. In 2023 the team said scanner signatures were still being added and advised manual checks over relying on antivirus alone.

What you can do

Each habit below comes from a source in the pack. We have added none of our own.

• Scan mod files with a tool built for the incident. The team's guide lists Overwolf's scanner (pointed at your instances folder), douira's online scanner and cortex's nekodetector.
• Look for traces of the later stages. On Windows the guide says to look in the local app data folder for a folder named Microsoft Edge with a space in it, which the malware used to disguise itself. Linux has three listed file paths, and the guide says macOS did not appear to be affected.
• The Microsoft moderator's answer advises sticking to popular mods with good reviews, treating any mod that arrives as an .exe file as wrong, and checking files with VirusTotal or an antivirus program.
• Back up what you cannot lose. The guide lists this as a first step for anyone infected and says to do it regularly anyway. Our world backup guide covers the files.
• In June 2023 the team advised avoiding fresh uploads from new or unknown authors and holding off on updates.

What this means for mods, packs and shaders

Mods are the case the record covers. They are Java Edition only, and a loader runs them from the mods folder, so the fractureiser findings apply to that route. The guide says you cannot be infected by joining a multiplayer server if you download nothing for it elsewhere. Our guide to what a Minecraft mod is explains the files, and the Java mod install guide shows where they go. For which download sources exist, see where to download Minecraft mods.

The sources we read say nothing about what a resource pack, a data pack or a shader pack file can or cannot do, so we make no claim either way. One fact does bear on shaders. On Java they need Iris or OptiFine, which are themselves Java mods, so a shader setup includes mod files. Our shader install guide covers that setup.