Read the mod.
Don't run it.
RatScan opens a Minecraft .jar the way a disassembler does: it parses the
bytecode, follows data between methods, and flags token stealers, droppers and remote loaders
only when the evidence connects.
Runs in this tab via WebAssembly. The file is never uploaded.
50 4b 03 04 starts each archive entry. The scanner reads from here, entry by entry.
Verdict
Risk score
/100
Parses, never executes
Classes are decoded from the archive bytes, including nested jars. No JVM is started.
Follows the data
A value read from a token file and sent to a webhook is a chain; the two APIs alone are not.
Says what it missed
Analysis gaps are listed in the report. Heavy obfuscation or unparsed classes keep a mod from being called clean.