AntiRat

AntiRat runs through Fabric's language-adapter and preLaunch phases before ordinary mod initializers. Its bounded scanner examines:

• compiled class constant pools and behavioral scopes;
• configuration and text resources;
• nested archives and concealed class/archive magic;
• native artifacts and suspicious archive structure;
• split constants, high-entropy payloads, and known credential or egress capabilities; and
• bounded decoding layers including Base64, URL-safe Base64, hex, percent escapes, Java escapes, reversal, ROT13/Caesar shifts, short XOR, gzip, and zlib.

Obfuscation, networking, token APIs, nested JARs, native files, or entropy are not individually enough to quarantine a mod. High-confidence containment requires correlated behavior such as a credential source plus an exfiltration capability, multiple independent credential-source categories, or concealed executable code paired with sensitive-file access.

When mod code requests a Minecraft session credential, AntiRat attributes the live call chain to its source JAR and validates it against the startup SHA-256 identity. A recent successful full-hash comparison is cached for five seconds so a caller polling the API cannot hash a large JAR every frame; metadata changes force the full comparison immediately. Safe verified callers remain compatible, while risky, changed, locked-down, or unattributed callers receive empty spoofed data.

Coverage includes standard session accessors, session IDs, direct field access, reflection, nested reflection, MethodHandles, method references, VarHandles, Unsafe routes, Authlib join-request credential carriers, and Mixin handlers copied into User or Session. Copied handlers are instrumented inside the Minecraft-owned target so constructor arguments are spoofed before the first handler instruction can read them. Original Minecraft and Microsoft authentication origins are treated separately so AntiRat does not intentionally interfere with normal server authentication.

Runtime enforcement covers common stealer behavior across:

• Minecraft launcher account stores, Discord data, browser profiles, Firefox data, keychains, keyrings, wallets, and process metadata;
• Files, streams, channels, providers, file URLs, reflective constructors, MethodHandles, asynchronous channels, and file-backed JDBC URLs;
• Discord, Slack, Telegram, and collector-style webhooks;
• URL, HttpClient, WebSocket, sockets, datagrams, DNS, socket factories, channels, desktop browsing, and direct Netty destinations;
• child processes, process pipelines, environment harvesting, risky native-library loads, raw Unsafe memory, and runtime class definition; and
• private AntiRat state and instrumentation tampering.

AntiRat does not record credential values, request bodies, file contents, or full process arguments. Reports store sanitized destinations, source identities, hashes, categories, scores, and detection evidence.

Critical startup detections are moved from mods to .antirat/quarantine/<timestamp>/ before their normal initializer can run. Required dependents are disabled when necessary so the next launch can resolve cleanly.

If Windows keeps a discovered JAR open, AntiRat suppresses its Fabric entrypoints, denies its guarded capabilities, creates and hash-verifies the quarantine copy, and starts a minimal helper that removes the locked original after the game process releases it. The report distinguishes this pending state from both a completed move and a failed quarantine.

Runtime detections immediately deny the attributed source's guarded capabilities and move its original JAR in a background containment task. Minecraft is not deliberately restarted in-world because abruptly terminating the client can damage world state. Already-loaded malicious code cannot be safely unloaded from a shared JVM, so it remains locked down until the player exits normally; the next launch omits the quarantined JAR.

AntiRat consumes its commands locally before they can be sent to a server.

/antirat list
/antirat placeholder
/antirat info <mod-id>
/antirat scan <mod-id>
/antirat quarantine <mod-id>
/antirat unquarantine <mod-id> [confirm]

placeholder opens a transient preview directly and does not publish a fake security event or chat notification. scan is read-only. Manual quarantine never restarts Minecraft. Unquarantine verifies the stored hash, refuses to overwrite an active version, and requires confirm when restoring a high-confidence detection.

Every supported target was compiled, unit-tested, and launched independently through Fabric Loader 0.19.3. An inert adversarial runtime fixture attempted 41 guarded behaviors and then opened the complete animated threat-details panel on each version. A target passed only after a real post-resource-reload frame reached the end of its entrance animation with the bundled logo ready and the evidence section still inside the panel bounds.

The fixture exercises session and Authlib access, credential files, file-copy and file-URL paths, reflection, constructors, scanners, MethodHandles, method references, asynchronous channels, JDBC, processes, pipelines, environment access, native loading, sockets, DNS, dynamic code, Unsafe, tampering, attribution, non-crashing memory containment, and runtime quarantine.

A locally reviewed startup false positive can be allowed by exact SHA-256 in config/antirat.properties:

allow.sha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

This exact-binary review override also permits ordinary runtime capabilities such as Unsafe, native loading, and child processes, but it does not permit fixed credential-exfiltration endpoints or session-token access. A mod that genuinely requires the token needs a separate exact-binary override:

allow.credentialSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

Treat a credential override as explicit trust in that exact file. Neither override is required for normal use.

AntiRat materially raises the difficulty of stealing credentials from a Fabric mod, but it is not an operating-system sandbox and does not claim perfect protection. Fabric mods share one JVM, filesystem identity, memory space, and network namespace.

The following remain outside or beyond a client-only mod's strongest guarantees:

• a compromised launcher, Fabric Loader, JVM, or operating system;
• native exploits that escape Java instrumentation;
• code that executes before Fabric can expose AntiRat;
• phishing, password theft, or Microsoft-account compromise outside Minecraft; and
• entirely novel behavior that is indistinguishable from legitimate authentication before a credential is released.

Do not intentionally execute real malware to test AntiRat. 

AntiRat is available under the MIT License.