What could go wrong?

key points to note:

CurseForge itself is not compromised in any way

a user made several accounts (now banned) uploading projects with malware. the Luna Pixel Studios situation was hacked separately, uploading similar malware. LPS and CF are in contact.

they're in the process of going through all relevant projects/files and will be deploying more security measures in future. no new files will be approved until this is resolved.

DO NOT delete your curseforge client as this will not solve the issue. CF intends to deploy a fix for this through the client.

DO scan your PC for malware and avoid downloading files from new accounts for the next few days.

an additional update on this, for people who very much want all of the available information, here is the technical write-up/ongoing document on what the maleware does, how to detect it, what is believed to be compromised, and what to do if you believe you may have been compromised. the hack is known to affect linux and windows; other operating systems are currently believed safe. if you have downloaded and run a modpack since may 22nd until july 6th, please check using the steps in the document below for infected files. if you have not done that, you are safe (although you should probably delete any mods believed to be infected). if you do not use windows or linux, you are safe. if you perform the steps below and find nothing, you are safe.

if you perform the steps below and find something, know that, currently, the server the maleware was communicating with has been taken down. you should act as though your passwords were compromised.

the infected files are unlikely to be detected by your current anti-maleware, so make sure to manually check if you believe you have been compromised!

curseforge has also released a script you can run to check for the files.

this is the current list of known infected mods (as of june 7th, 2 PM UTC):

Golem Awakening

Phanerozoic Worlds

Autobroadcast

Museum Curator Advanced

Vault Integrations (Bug Fix)

AmazingTitles

dungeonx

HavenElytra

DisplayEntityEditor

The Nexus Event Custom Event

SimpleHarvesting

McBounties

More and Ore advanced

Easy Custom Foods

AntiCommandSpam Bungeecord Support

UltimateLevels

AntiRedstoneCrash

hydrationPlugin

NoVPN

Fragment Permission Plugin

Anti ChatReport

Additional Weapons+

Just Enough Ingots

note that vault integrations is not the official vault hunters mod; douwsky has confirmed that is an unofficial mod. these mods have all been removed from curseforge and cannot be currently downloaded. if you don't have one of these mods, you might be safe, but still run a check to be certain! the maleware is designed to replicate itself across all jar files on your system (yikes), and so if you ran one of these mods while it was infected, it still may be present on your system.

as of now, the maleware is believed to have been neutralized (the server it communicates its payload to is offline). however, still behave as though you may have been compromised.