🛡️ Solar JAR Scanner
Checks your Minecraft plugin/server JARs for the "Solar" infector — a real, undocumented JAR-injection campaign that hit at least 5 German Minecraft networks between Feb–Aug 2026. Everything runs in your browser. Your JARs are never uploaded anywhere.
What this is
A researcher who goes by Plattio found their Minecraft network compromised by a JAR infector with no public write-up anywhere — not on PaperMC forums, not in any vendor blog, not in MCAntiMalware's signatures — and published the full technical breakdown so other operators could check their own systems. This tool automates the signature check from that write-up. Full original write-up →
It looks for constant-pool strings that only appear once a JAR's class files are actually
extracted (a plain grep on the .jar itself finds nothing — the classes are DEFLATE-compressed)
plus the zero-width-space filename trick the loader uses for persistence in ./logs.
Don't take "nothing gets uploaded" on faith — the full source is on GitHub, or just open your browser's Network tab while you use it.
Drop your plugin JARs (and your server core / paperclip jar — this campaign hides in both) here, or click to choose files
Prefer not to upload anything, even locally?
Run this directly on your server instead — same three checks, straight from the original write-up:
# 1. Persistence outside the plugin folder (survives a full plugin wipe) find /path/to/server -name "*$(printf '\xe2\x80\x8b')" -ls # 2. Signatures on EXTRACTED classes (a plain grep on the .jar finds nothing) unzip -o plugin.jar -d /tmp/extracted && grep -ral \ "czBsYXIubmV0\|cC5Bc3luY1RpbWluZ3M=\|bmV0LnMwbGFyLlNvbGFyTG9hZGVy" /tmp/extracted # 3. Orphaned 0-byte temp JARs find /tmp /var/tmp -maxdepth 1 -name '*.jar' -size 0
What this does NOT check
This is a signature check against one specific, documented campaign — not a general malware scanner. It won't catch a variant that changes its strings/passphrase, and it doesn't do the write-up's deeper "Layer 2" structural bytecode analysis (nop-padding, shifted debug tables). A clean result here is real evidence, not a guarantee. If you find a hit, read the full write-up before doing anything else — a plugin swap alone does not fix this.