Is Modrinth Safe in 2026? App, Viruses and Malware Scans

Published on | Updated

Yes, Modrinth is safe: it scans every upload and reviews new projects. The one gap, whether the Modrinth App is safe, and how to check a server's mods folder.

First-person view of an iron pickaxe mining diamond ore in a dark Minecraft cave

Yes: as of 31 October 2026, Modrinth is safe to download mods from. Every file uploaded to it goes through Modrinth's own malware scanner, which decompiles the code and flags suspicious parts for staff, and new projects are scanned and then reviewed by human moderators before they go public. Below is the one gap to know about, whether the Modrinth App is safe, and how to check a server's mods folder.

Quick answer: Modrinth is safe for normal mod downloads. Its open source backend sends every uploaded file, updates included, to an in-house anti-malware scanner, and staff review what it flags. The gap: after a project is approved, new versions go live without waiting for a moderator, which is how Windows Borderless, the one malware case on Modrinth's news page, got through in May 2024; about 372 distinct IP addresses downloaded it. The Modrinth App is open source and warns before it installs files that are not published on Modrinth. Stick to well-known projects and check a server's mods folder by hash against Modrinth's API.

Reading in Polish? Czy Modrinth jest bezpieczny? answers the same safety question in Polish, with a short section on Prism Launcher.

What Modrinth Scans Before and After a Mod Goes Live

Modrinth's code is public on GitHub: the website and backend under AGPL-3.0, the Modrinth App under GPL-3.0. So you can read how uploads are handled instead of taking anyone's word for it.

  • Every uploaded file is scanned. New projects, new versions and extra files alike go to Modrinth's in-house anti-malware scanner, which the code calls Delphi. It decompiles Java files and rates its findings from low to severe; its scan reports have been in the code since August 2025.
  • Flagged files get a technical review. Staff mark each suspicious finding as safe or unsafe. An unsafe verdict rejects the project and hides it from the public.
  • New projects get a human review. Modrinth tells creators that a new project "will be scanned and then reviewed by human moderators to ensure it meets Modrinth's Content Rules and Terms of Use." In June 2026 it said over 600 projects are submitted every day.
  • The rules ban the usual tricks. The Content Rules, last changed on 13 August 2026, ban impersonation, reuploads without permission, and content "designed to upload any data to a remote server" without clear disclosure.
  • New modpacks must explain bundled files. Since 23 June 2026, a new modpack that bundles files from outside Modrinth must show permission for each of them, and a version with unknown bundled files is withheld from the public until then.
  • Anyone can report. Every project, version and user page has a Report button, with "Malicious" as one of the reasons.

The Gap: Updates Do Not Wait for a Moderator

The human review happens once, at first submission. After approval, a new mod version is listed the moment the creator uploads it, and the scan starts once the upload is saved. A mod that was clean in January can ship malware in a June update, and people can download it until the scanner, staff or a user report catches it.

That is exactly what happened in 2024. From Modrinth's own disclosure:

Date in 2024What happened
29 April"Windows Borderless" is submitted for review with one file that contains no malware
30 AprilModerators approve the project
2 MayA new version sends identifying information about the user's machine to a Discord webhook
4 to 6 MayMore versions add credential and token stealers
6 MayA user reports that their Discord account was compromised after using the mod
6 May, about three hours laterStaff decompile the mod and within minutes take down the project, its download links and every other project by the same users

The malware ran only on Windows and went after data that browsers such as Chrome, Edge and Firefox and the Discord app keep on your PC, which can include account tokens, saved passwords and banking details. About 372 distinct IP addresses downloaded the files, none of them were in a Modrinth modpack, and Modrinth published their SHA-1 hashes and an open source detection tool. Today the scanner above checks every update by machine, even though no moderator approves it first.

Does Modrinth Have Viruses?

Malware has reached Modrinth before and could again, but the one case it has disclosed was gone within hours of the first report. Windows Borderless is the only malware disclosure on Modrinth's news page (checked 31 October 2026). Two caveats:

  • A disclosure is not a count. The news page lists incidents Modrinth wrote up. A project that the scanner flags and staff reject simply disappears, without a post.
  • fractureiser did not reach Modrinth. fractureiser was found in projects on CurseForge and BukkitDev in June 2023, and CurseForge says the infected files were downloaded about 6,500 times. Modrinth scanned the last 10 months of uploads and found no infected projects. The investigators called that "entirely luck" and wrote that "Modrinth is just as safe as CurseForge is."

And your antivirus? CurseForge says fractureiser was engineered to infect only mod jars, "thus evading detection by all commercial anti-virus software", so a clean scan proves little. An alert alone does not settle it either: Modrinth's report form does not accept summaries from Microsoft Defender, VirusTotal or AI malware detection as evidence and asks for code samples instead. Treat an alert as a reason to remove the file and look closer.

Is the Modrinth App Safe?

Yes, if you download it from modrinth.com/app. It is open source under GPL-3.0, still labelled beta, and at version 0.22.1 from 29 October 2026. In 2026 it gained warnings for files that do not come from Modrinth:

  • Since version 0.13.7 (29 April 2026) it shows a safety warning before it installs a .mrpack modpack file that is not hosted on Modrinth, "to help prevent users from getting tricked into installing malware".
  • Since version 0.15.11 (14 July 2026) it also warns before it installs a single mod file that is not published on Modrinth, and the pack warning lists the outside files with not installing as the main button. In Modrinth's words: "Malware is often distributed through mod files by sharing them on platforms like Discord."
  • Shared instance and server invites say "This invite was created by another Modrinth user, not Modrinth. Only accept invites from people you trust." Since version 0.22.0 (21 October 2026), executables cannot be pushed to a shared instance.

The pack warning has a switch in the settings, "Warn me before installing unknown modpacks". Leave it on. Keep the App updated too: versions 0.10.9 and 0.10.16 in October 2025 fixed security holes in .mrpack importing. On Windows and macOS the App downloads updates itself (not on a metered connection) and applies them when you reload or close it; on Linux, update through your package manager. Our Modrinth App setup guide walks through the install, and if you play through Prism Launcher, see is Prism Launcher safe.

How to Check a Server's Mods Folder

A server loads every jar in mods, and on Paper every jar in plugins, with the same access to files as the server itself. If you took over a server or installed a pack from a ZIP someone sent you, compare each jar with what Modrinth publishes. It is the test the Modrinth App runs before its unknown files warning: hash each file with SHA-1 and ask Modrinth whether it knows that hash.

  1. Download the folder. Copy mods (and plugins) to your computer over SFTP or with your panel's file manager. On a Space-Node Minecraft server you can use the browser file manager or your own SFTP client.
  2. Run the check. Open a terminal in the folder that contains mods and run:
cd mods
for f in *.jar; do
  h=$(sha1sum "$f" | cut -d ' ' -f 1)
  code=$(curl -s -o /dev/null -w '%{http_code}' -A "mod-check-yourname" \
    "https://api.modrinth.com/v2/version_file/$h?algorithm=sha1")
  echo "$code $h $f"
  sleep 0.25
done

On a Mac, replace sha1sum with shasum -a 1. On Windows, open PowerShell in the same folder and run:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Get-ChildItem .\mods -Filter *.jar | ForEach-Object {
  $file = $_
  $hash = (Get-FileHash -LiteralPath $file.FullName -Algorithm SHA1).Hash.ToLower()
  try {
    $null = Invoke-WebRequest "https://api.modrinth.com/v2/version_file/${hash}?algorithm=sha1" -UseBasicParsing -UserAgent "mod-check-yourname"
    $code = 200
  } catch {
    $code = [int]$_.Exception.Response.StatusCode
  }
  "$code $hash $($file.Name)"
  Start-Sleep -Milliseconds 250
}
  1. Read the result. 200 means the jar is byte for byte a file published on Modrinth. Open the URL with that jar's hash in a browser: the name and project_id fields show which mod version it matches, so you can check it is the mod you think it is. 404 means Modrinth does not know this exact file. That is normal for CurseForge-only mods and for jars from a pack's server files, but it is also what a tampered copy looks like: in our test on 31 October 2026, adding one byte to a genuine Fabric API jar turned its 200 into a 404.
  2. Trace every 404. For a Modrinth pack, open the .mrpack file as a ZIP: modrinth.index.json lists each mod it downloads with its hashes and download link, and everything else ships in its overrides and server-overrides folders. For a CurseForge mod, download the same version from the mod's Files tab and compare the two hashes.
  3. Remove what you cannot explain. Stop the server, move the jar out, restore a backup from before it appeared and change your panel and SFTP passwords. Then report the project with what you found. Our backup strategy guide covers keeping copies off the server.

Modrinth's API rules allow 300 requests per minute and ask for a user agent that identifies you, so put your own name in place of yourname. The short pause keeps even a big modpack under the limit.

Modrinth vs CurseForge on Safety

ModrinthCurseForge
Automatic scanEvery uploaded file goes to an in-house scanner that decompiles itEvery file runs "over a dozen" automatic tests, including several anti-virus scans; every Minecraft mod file is decompiled and tested
Human reviewEvery new project; flagged files get a technical reviewThe project page is reviewed each time a project is created or updated; risky files are rejected or escalated to a manual review
Best-known malware caseWindows Borderless, May 2024, about 372 distinct IP addressesfractureiser, June 2023, about 6,500 downloads

Both scan every upload and both have had malware get through, so let the mods you want decide. Our Modrinth vs CurseForge comparison has the full verdict, and Is CurseForge safe? covers CurseForge's side, including the Discord modpack scams it warned about in 2026.

Safe Habits on Any Platform

  1. Download from the official project page or inside the Modrinth App, never from a reupload site, a mirror or a Discord message.
  2. Check the author, the project's age and its downloads. A near-identical name with a few hundred downloads next to a popular mod is a red flag.
  3. Read the version list before you update. A release after a long quiet spell can wait a few days.
  4. Prefer mods that link their source code, and never open a .mrpack or .jar that a stranger sends you.
  5. Back up your world before you add mods to an existing save.

FAQ

Is Modrinth legit? Yes. Modrinth is run by Rinth, Inc., entered beta in December 2020, and lists more than 166,000 projects in its public statistics (31 October 2026). Since February 2026 it has been part of Spark Universe, the company behind the Essential mod, and when it announced the deal in June it promised to stay open source and not to merge with Essential.

Are all mods on Modrinth safe? No site can promise that. Every upload is scanned and new projects are reviewed, but updates go live without a moderator, and a scanner only catches what its checks recognise. Well-known projects with a long history and public source code are the safest picks.

Does Modrinth check for viruses? Yes. Every uploaded file, updates included, goes to Modrinth's in-house anti-malware scanner, and suspicious findings go to staff for a technical review. New projects are also reviewed by moderators before they go public.

Is Modrinth safer than CurseForge? Neither is clearly safer. Both scan every upload and review new projects, and both have had a well-known malware case. The fractureiser investigators put it this way: "Modrinth is just as safe as CurseForge is."

Is Modrinth Hosting safe? It is Modrinth's own server rental, run in-house by the Modrinth team since March 2025 and still marked beta. Its page lists DDoS protection and 15 off-site backups for every server (checked 31 October 2026). The mods on it are the same files as on the website, so the checks above still apply. Our Modrinth Hosting review covers plans and limits.

Can mods from Modrinth have viruses, and what do I do if I ran one? They can: a mod is Java code with the same access to your files as Minecraft itself. If you ran a mod you now distrust, close the game, delete the mod and run a full antivirus scan. From another device, change the passwords for your Microsoft account, Discord, email and anything saved in your browser, and watch your bank accounts: that is the data Windows Borderless went after. Then report the project on Modrinth.

Sources

All opened on 31 October 2026: