macOS malware detection blocks safe Minecraft mod with no way to override

I need to know if there is a way I can override the MacOS malware detection, as it is currently flagging something that I know to be safe as malware. I have two instances of Minecraft (in Prism Launcher, on version 1.16.1) that I can no longer open because one of the mods I have installed is being flagged as malware. The mod itself is MCSR Fairplay, a mod that is known to be safe, and which I downloaded from a reputable source (originally Modcheck). The .jar file itself is not what is being flagged - it is the dynamic library file that is generated by the mod in order for it to run. I have had this mod downloaded for the past several months, and I have not encountered any problems running these instances until now. I have double-checked the files using both VirusTotal and also MalwareBytes. Nothing has shown up. I know other people who have this mod and are able to run their instances just fine, as I was able to do up until now.


My Mac is running the latest version of MacOS. I have tried rebooting my laptop, reinstalling the mod, installing it directly from the MCSR mods list instead of using Modcheck, and putting the mod on new instances. Every time the OS blocks the file and I cannot run the instance. This is very frustrating, and I would appreciate any help on overriding it without turning off the entire malware detection system, as I value my security.


MacBook Pro 13″, macOS 15.7

Posted on Apr 4, 2026 3:56 PM

Reply
6 replies

Apr 6, 2026 7:20 PM in response to loth34

loth34 wrote:

This is the link to the official MCSR Fairplay Github (https://github.com/ExeRSolver/mcsr-fairplay-public), as well as the link to the MCSR allowed mods list (https://mods.tildejustin.dev/) - it is 100% supposed to be downloaded, as most Minecraft mods are, and I do know what I am doing in that regard. I have experience using mods on Minecraft and know how they work. I am confident this does not contain malware, as other people on Macbooks that I know also have this mod and it runs fine

Have they tried to install & use the same version from the website you are trying to use? Something could have happened to the file since others have accessed it.


Does the site use checksum hashes to verify the files have not been modified or corrupted? If not, then that is a huge risk since there is no way to know their integrity.


Are these other users who are successfully using this mod (recently downloaded & installed)....are they also using a current & supported version of macOS? If not, then their version of XProtect signatures may be outdated & not be aware their system is infected with malware.


If these other Mac users are successfully using the currently downloaded mod & are running the same version of macOS as you are, then how did they get it to work? Or have they used an older download of the mod (version number can be the same)?


- I have even gotten them to send me their copy of the .jar file that runs this mod and it still does not work and marks the .dylib as malware, where on their mac it does not.

Is this ".dylib" file included in that copy of their .jar file?


I sincerely doubt that the malware detection on MacOS, or any other operating system, is 100% accurate at all times.

Nothing is 100% accurate. I believe Apple uses "signatures" to detect malware. So it should be fairly accurate, unlike other anti-virus products which try to predict trouble. Also, I believe if Apple detects an app trying to do something to the system that it will block it as well. See the following Apple article for details:

Protecting against malware in macOS - Apple Support


If you truly think it's malware, I would be interested to hear any ideas why it is only creating/running malware on my specific device.

You could have some malware on your system that has evaded detection and has decided to infect this file. It may be the source is unrecognized, but once the source delivers its payload, then macOS is able to detect a problem.


If the files you download are not provided with a hash to verify their integrity, then you don't know if the file is the same exact file as a developer posted to the site. I'm sure miscreants are actively targeting popular games that include mods since many people will download anything from anywhere without the proper research & verification. I'm not saying you have done this, but just in general.


Have you verified the name of the file with the mod developers? @Kurt Lang mentions that the file name looks very suspect & typical of malware infection....and I agree. I personally would not trust that file based on the name alone even if macOS had not triggered an alert.



Last year there was a malware spike in Minecraft mods....see the following two articles (I'm sure it has not stopped):

https://www.bleepingcomputer.com/news/security/stargazers-use-fake-minecraft-mods-to-steal-player-passwords/


https://research.checkpoint.com/2025/minecraft-mod-malware-stargazers/

Apr 5, 2026 10:37 AM in response to loth34

macOS only blocks items that are proven to be, or contain malware. You do not want to override it. The fact that .dylib is part of the name twice is a common Windows trick to try and hide the actual file name.


That, and from what I can find after searching for about 15 minutes, FairPlay is not something meant to be downloaded. It is a streamed DRM supplied by the software that uses it without any interaction necessary by the user.

Apr 5, 2026 6:43 PM in response to Kurt Lang

This is the link to the official MCSR Fairplay Github (https://github.com/ExeRSolver/mcsr-fairplay-public), as well as the link to the MCSR allowed mods list (https://mods.tildejustin.dev/) - it is 100% supposed to be downloaded, as most Minecraft mods are, and I do know what I am doing in that regard. I have experience using mods on Minecraft and know how they work. I am confident this does not contain malware, as other people on Macbooks that I know also have this mod and it runs fine - I have even gotten them to send me their copy of the .jar file that runs this mod and it still does not work and marks the .dylib as malware, where on their mac it does not. I sincerely doubt that the malware detection on MacOS, or any other operating system, is 100% accurate at all times. If you truly think it's malware, I would be interested to hear any ideas why it is only creating/running malware on my specific device.

Apr 5, 2026 9:15 PM in response to MrHoffman

As far as I know, yes, I can maybe double check - but I wouldn't think the version or config would be the issue, since I can't find anything that would suggest recent updates have changed the Java version, and I have not changed it or touched it at all in the time in which I have been using this mod. It worked just fine for the first several months, and it was only a few days ago that it started having this issue. I could be wrong though

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

macOS malware detection blocks safe Minecraft mod with no way to override

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.