What this scanner checks

It looks for the patterns seen in real attacks. It does not know everything, so here is exactly what it does and does not do.

The three results

What it reads

• Any file: its name, and its first bytes, to see what it really is. A program renamed to .package or .png is caught this way.
• .ts4script: opened as a zip. Each compiled Python file is parsed properly: which modules it imports, which functions it calls, including through renamed imports, and every text and data constant. Python files are never run.
• .package: the header and the list of resources, plus a spot check inside resources for hidden programs. Package contents such as tuning are not judged.
• .zip: opened and checked file by file, two levels deep, so you can check a download before installing it.

The checks

Things that have no place in Mods

• Programs and scripts: .exe, .dll, .bat, .cmd, .ps1, .vbs, .js, .jar, .lnk, .msi, .scr and more.
• Files whose contents do not match their extension.
• Double extensions like Hair.package.exe, and names using hidden text direction characters.
• A program packed inside a .ts4script or a .package, or added to the end of one.
• A .ts4script arriving next to plain CC with no tuning, inside one download or folder.

What script code can do

• Download and start something in the same function, or hold a direct link to a program file.
• Start programs: subprocess, os.system, os.popen, os.spawn*, os.exec*, and os.startfile for opening files.
• Go online: socket, urllib, http.client, requests, ftplib and others.
• Reach outside Python: ctypes, compiled .pyd modules, and changes to the Windows registry.
• Mention password stores, chat token folders, wallet files, message webhooks, Windows startup locations, or command tools such as PowerShell.
• Point at paste sites, file drops, link shorteners or bare IP addresses.

Hidden code

• Long base64 or hex text, byte strings and lists of numbers are decoded, through zlib and gzip too. Programs inside are flagged. Python inside is unpacked and put through the same checks.
• exec, eval, marshal.loads and imports by name, reversed text, scrambled names, and code protection tools such as PyArmor.

Known signs from past incidents

• The two SHA-256 fingerprints published in Overwolf's cleaner, for Updater.exe and main.exe.
• The four script names from November 2024, and mod.pyc.
• The marker silkrose_debug, as a file name or inside code.
• out.exe, install.exe, install.bat.
• Titles from public warnings, as a gentle prompt only, because most files with those names are genuine.

Housekeeping

• .ts4script more than one folder inside Mods, and .package more than five, which is the depth the game's default settings read.
• Exact duplicates, and same name with different contents.
• Damaged packages, packages from older Sims games, scripts built for an old Python, and Tray files in Mods.

What it cannot detect

• New tricks. Anyone can read this page and write code to avoid it. It looks for patterns, so a clean result is never proof.
• Anything that only appears at runtime. Nothing is run, so code that builds its behaviour while running, fetches instructions later, or waits for a date cannot be seen.
• Attacks split across a mod. If fetching and starting are in different functions or files, the result is "Look closer" at most, the same as respected mods get.
• Strong encryption or custom encoding. Only common encodings are unpacked. Encrypted data just looks like noise.
• Compiled native code. It is flagged, but it cannot be read.
• Bad things using only normal game code. A mod can damage a save using ordinary game functions and look fine here.
• What is inside tuning and images. Package contents are only spot checked: big files over 96 MB get a structure check only, and older style compressed resources are not unpacked. RAR and 7z archives are not opened.
• Your computer. This looks at files you pick. It cannot tell you if something has already run. For that you need antivirus.
• Whether a mod works. It does not test for conflicts, or for breaking after a game patch.

The known names and fingerprints only cover what has been published, and most incident reports give no hashes. We have never tested this against a real malware sample, because none was publicly available to us. It has only been tested against harmless files we built to imitate reported patterns.

How often it flags good mods

We scanned public mods from CurseForge to see how often it complains about things that are not malware. In November 2026 that was 713 downloads from 44 creators: 2,327 files, of which 160 were script files and 1,278 packages.

That zero is flattering, because we fixed rules after seeing what they flagged. The fairer number is from files the rules had not seen yet: 2 of 543 downloads (0.4%), or 2 of 106 script files (1.9%), were wrongly told "Do not use". One was a Python library's leftover batch file, and the other was a mod that packs its own code. Both now get "Look closer". Expect wrong "Do not use" results to happen sometimes.

The "Look closer" group includes WonderfulWhims, Better BuildBuy, Better Exceptions and ModGuard itself. An early version of these rules told people not to use several of those, which is why the strongest result now needs fetching and starting in the same function.

How we measured: newest public file of each project on CurseForge, scanned as a player would get it, read as data and never run. We assumed these are not malware, but did not prove it. CurseForge reviews uploads, so results elsewhere may differ, and Patreon, creator sites and adult mod sites are not in this sample. Files over 40 MB were skipped, and most of the 160 scripts come from a small group of creators. We have no figure for how much real malware this catches.

A flag on a popular mod does not mean the mod is bad. Many respected mods, including anti-malware tools, have good reasons to do things that look risky. That is why "Look closer" asks you to check the source.

Other tools worth knowing

This page does one job: it reads files in your browser before you use them, with no install and no upload. It does not replace any of these. We have not tested them, so these descriptions come from their own pages or coverage of them.

Privacy

There is no upload, no account and no analytics on this site. Scanning runs in your browser, and a connect-src 'none' security policy tells the browser to refuse all network connections from these pages.