Is CurseForge Safe in 2026? What It Scans and What It Misses

Published on | Updated

Yes, as of 31 October 2026, if files come from curseforge.com or the app. What CurseForge scans, where malware still gets in and how to check a server's mods.

A snowy Minecraft mountain slope with spruce trees under a blue sky

Yes, CurseForge is safe to download from as of 31 October 2026, as long as the file comes from curseforge.com or the official CurseForge app. The risk sits in files from anywhere else: a reposted mod, a fake mod on GitHub, or a modpack ZIP a stranger sends you on Discord.

Quick answer: CurseForge, run by Overwolf, says it scans "all files that you download directly through our app or website for malware and malicious code": every upload goes through more than a dozen automated tests, including several antivirus scans, and suspicious files go to a person. That stops a lot, not everything: fractureiser got through in 2023, and once it was found in June, CurseForge removed the infected files within 10 hours, after about 6,500 downloads. Install from the project page or the app, check the author and the file history, and on a server, compare the mods folder with the official server pack.

En español: sí, CurseForge es seguro en 2026 si descargas desde curseforge.com o desde la app oficial, porque revisa cada archivo subido en busca de malware. El peligro está en copias de otras webs y en modpacks enviados por Discord. La guía completa en español, con la comparación con Modrinth, está en ¿CurseForge es seguro? Modrinth o CurseForge en 2026.

What CurseForge Scans Before You Can Download a File

CurseForge's 2023 incident report says every uploaded file goes through "over a dozen" automatic tests, "including several anti-virus scans, file structure scans, compliance tests and more"; a file that fails the malware check is rejected with "Malware detected in file" (file processor errors). A moderator reviews the project page whenever a project is created or updated, and suspicious files go to a security expert at Overwolf, who runs extra tests and, when relevant, tries the mod in the game.

For Minecraft mods, the May 2024 post Our Mod Approval Process adds five steps:

  1. The jar is decompiled into readable Java code.
  2. Every class is hashed and compared with files CurseForge has processed before, and a match with known malware is rejected automatically.
  3. Static analysis tools look for common issues and security risks.
  4. Suspicious classes go through more advanced tools.
  5. The file is rejected outright or sent to manual review.

A new project cannot be downloaded until both its page and its file are approved (project statuses). The moderation policies ban external download links, and a modpack may only include mods hosted on CurseForge or on its approved list of outside mods.

CurseForge admits its tools "are not perfect" and that "no process is bullet-proof", and the fractureiser investigators called stopping that kind of attack at platform scale "non-feasible". CurseForge also only checks what is on CurseForge: "We cannot scan or verify modpack files sent to you by your friends and imported via the CurseForge app" (May 2026).

Is CurseForge Legit? Who Runs It

Yes. Twitch bought CurseForge in 2016 and handed it to Overwolf in June 2020, when it had "over 110k mods from more than 40k active authors", and Overwolf still runs it. CurseForge shows ads and shares 70% of ad revenue with mod authors.

Does CurseForge Have Viruses? The Fractureiser Case

Malware got through once on a large scale. Fractureiser was widely uncovered on 7 June 2023, the morning Minecraft 1.20 came out. The attacker uploaded infected mods from new accounts to CurseForge and dev.bukkit.org, and a developer at Luna Pixel Studios, a major creator on CurseForge, got infected by testing one, which let the attacker push infected files to the studio's popular projects. Once an infected jar ran, later stages tried to infect every jar on the PC and steal browser cookies, logins and Discord, Microsoft and Minecraft credentials (player guide). Only Java Edition on Windows and Linux was hit, and joining a server alone could not infect you.

CurseForge says the malware was built to evade "all commercial anti-virus software." Within 10 hours it blocked the attacker's accounts, scanned its whole database, removed the infected files and released free detection tools. The infected files were downloaded about 6,500 times, on a platform that "typically sees tens of millions of file downloads each day." The investigators' verdict: "CurseForge itself is not compromised, only individual users." No follow-up infected first stages were ever found.

Still have mods from February to June 2023? The investigators say to treat those downloads as potentially malicious. CurseForge's detection tool article links Overwolf's free detection tool for Windows and Linux, which checks whether your PC is infected, and its Jar Infection Scanner for Windows, which scans a folder of jars, subfolders included. Both look for fractureiser only.

Is the CurseForge App Safe?

Yes, if you download it from the official download page. The app installs mods from the same scanned files as the website. On Windows you pick one of two builds:

Overwolf versionStandalone version
What gets installedThe CurseForge app plus the Overwolf clientOnly the CurseForge app
Minecraft Java EditionYesYes
ExtrasIn-game overlay, second monitor support, more gamesFewer games, lighter install

Overwolf's CurseForge listing says it plainly: "Downloading this app will install the Overwolf Client." Minecraft modding does not need that client, so the standalone build is the leaner choice. If you already have the Overwolf version, its uninstaller can remove Overwolf as well and leaves your installed mods in place.

The free app shows ads, and you never need to click one to get a mod. CurseForge Premium removes them for $2.99 a month or $30 a year (checked 31 October 2026). In May 2026 CurseForge also described two newer safety features: the app highlights potentially suspicious override files when you import a modpack ZIP, and a "CurseForge Files Only" option installs only verified, scanned files from CurseForge.

Where the Real Risk Is in 2026

Where the file comes fromChecked by CurseForge?
A mod or modpack installed from its CurseForge page or in the appYes, every upload goes through the automated checks
A modpack ZIP someone sends you, imported into the appNo, CurseForge says it cannot scan or verify these
The same mod from a repost site, a GitHub repo or a Discord linkNo

Fake modpacks on Discord. In May 2026 CurseForge warned about scammers posing as trusted community members. One asked a player to help record a surprise video on a private server and sent a small ZIP as the "required" modpack. Inside, EchoVoiceBeta-1.0-SNAPSHOT.jar could run PowerShell or shell commands and download more malware, most likely to steal Minecraft accounts, Discord tokens and browser cookies. As CurseForge puts it, "these attacks are not coming through CurseForge itself."

Fake mods on GitHub. In June 2025 Check Point Research found fake mods posing as the cheat and macro tools Oringo and Taunahi on GitHub, in repositories that stars from fake accounts made look popular. They stole Minecraft and Discord tokens, browser logins and crypto wallets.

Repost sites. Copies of mods on other sites skip CurseForge's checks. StopModReposts, a campaign running since 2014 that lists known repost sites, warns that users "risk downloading malware or outdated mod versions".

A bad update on a real project. Fractureiser rode on genuine, popular projects, and a hijacked author account can do that again.

How to Check a Mod Before You Install It

  1. Start on curseforge.com or in the app. A link from a video, a forum or a Discord message should land on a curseforge.com page. If it does not, do not download.
  2. Check the owner next to "By" and the listed members against the mod's GitHub page or a modpack you trust.
  3. Check downloads and age. Just Enough Items has more than 640 million downloads and was created about a decade ago. A lookalike with a few hundred downloads, created last week, is a red flag.
  4. In the Files tab, pick a release for your Minecraft version and loader. A new file after a long silence, or a size jump with no changelog, is worth a few days' wait.
  5. Prefer mods with a Source link and a clear licence, like JEI (MIT License, source code on GitHub).
  6. Never import a modpack ZIP from a Discord DM, even from a friend. If you do import one, choose "CurseForge Files Only".
  7. Scan anything from outside CurseForge, for example with VirusTotal, as CurseForge suggests. A clean result proves little: fractureiser got past every commercial antivirus.

How to Check a Server's Mods Folder

A server runs the same jars as your players, and fractureiser hit server files too: CurseForge took three UVision server packs down for good, and the attacker also spread it through plugins on dev.bukkit.org.

CurseForge's file pages show no checksum, so the reliable test is a fresh copy of the official server pack. On the pack's CurseForge page, open Files, then the exact version your server runs, and download its server pack under Additional Files, not a reupload or a ZIP someone sent you. Stop the server and back it up first.

1. Compare every jar with the official pack. Unzip the fresh pack so its mods folder sits at official/mods, next to your server folder (here server). Run this from the folder that holds both, on Linux or in WSL on Windows:

(cd official/mods && sha256sum *.jar) | sort -k2 > official.txt
(cd server/mods && sha256sum *.jar) | sort -k2 > server.txt
diff official.txt server.txt

No output means every jar matches. A line starting with > is a jar only your server has, or one whose content differs from the pack's, in which case a < line with that name appears too. A < line on its own is a jar your server is missing. Every > line should be a mod you added on purpose. The same check in Windows PowerShell, where => marks those jars:

$official = Get-FileHash .\official\mods\*.jar | ForEach-Object { "$($_.Hash) $(Split-Path $_.Path -Leaf)" }
$server = Get-FileHash .\server\mods\*.jar | ForEach-Object { "$($_.Hash) $(Split-Path $_.Path -Leaf)" }
Compare-Object $official $server

2. Look for files that do not belong. Run these inside the server folder:

find . -name "*.jar" -not -path "./mods/*" -not -path "./libraries/*" -not -path "./plugins/*"
find . -type f \( -iname "*.exe" -o -iname "*.dll" -o -iname "*.ps1" -o -iname "*.vbs" \)

The first should show little more than the server or installer jar and your loader's own cache. A jar inside config, world or a folder you do not recognise needs an explanation. The second usually prints nothing on a Linux server. For "unexpected executables", CurseForge's advice is to stop and verify before launching anything.

3. Check what changed recently. Fractureiser tried to infect every jar on a machine, so a jar that changed while nobody updated anything is a warning sign. This lists the files in mods and config changed in the last 7 days:

find mods config -type f -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM  %p\n' | sort

On a Paper or Spigot server, run steps 1 and 3 on plugins as well. If something does not match, do not start the server: put the official files back, restore a backup from before the change, and change your panel and SFTP passwords. And send players to the pack's CurseForge page rather than zipping up your own mods folder.

On our modpack hosting, the panel's modpack installer sets up a listed CurseForge or Modrinth pack, and your own SFTP client can pull the mods folder down for these checks. On Minecraft 1.7 to 1.18, also apply the Log4j fix from Mojang's December 2021 notice.

What to Do If You Installed a Bad Mod

  1. Close Minecraft and the launcher, copy your world saves out, then delete the mod or the whole profile.
  2. Run a full antivirus scan, plus the two fractureiser tools for files from early 2023.
  3. From another device you trust, change the passwords for your Microsoft account (your Minecraft login), Discord, your email and anything saved in your browser, and turn on two-factor authentication.
  4. If a scan finds a password stealer, or you cannot rule one out, treat the PC as compromised. The fractureiser team's advice: back up your personal files, then have the machine checked by a professional or wipe and reinstall it.
  5. Report the project with the Report link on its CurseForge page, and the Discord account if the file came from there.

FAQ

Does CurseForge have viruses? The app is not a virus, and CurseForge scans every uploaded file. One large case got through: fractureiser, found in June 2023 and removed within 10 hours, after about 6,500 downloads of infected files.

Is CurseForge spyware? No, it is a legitimate mod manager from Overwolf. It shows ads and collects data, but Overwolf says "You're not required to sign in to use apps, and you could opt out from data collection." On Windows, the standalone build also leaves out the Overwolf client.

Is CurseForge safe for Sims 4 mods? Yes, if you install from the project page or the app: every file uploaded to CurseForge, for any game, goes through the automated tests, including several antivirus scans. Skip Sims 4 files that reach you any other way.

Is CurseForge safer than Modrinth? Not in a way that matters for your download. Both have had malware get through: fractureiser on CurseForge in 2023 and Windows Borderless on Modrinth in 2024. The fractureiser investigators put it plainly: "Modrinth is just as safe as CurseForge is."

Is it safe to import a modpack ZIP a friend sent me? Not without checking. CurseForge cannot scan ZIP files you import from outside, and in 2026 scammers send exactly these while posing as people you know. Install the pack from its CurseForge page, or choose "CurseForge Files Only" when you import.

Related guides: Is Modrinth safe?, Prism Launcher vs CurseForge vs Modrinth App, Modrinth vs CurseForge: which one to use and Is Prism Launcher safe?

Sources

All opened on 31 October 2026: