DonutLauncher refuses to run a small set of mods: cheat clients, and the ones that ship credential stealers alongside the cheating. They are quarantined rather than merely flagged, and the switch that would enable them is not shown, because offering the choice is the same as shipping them.
What gets blocked
- Named cheat clients, matched by their package names, their declared mod id, their main class and their jar name together rather than by the filename alone.
- "Cracked" builds of software — a cracked build is somebody else's binary with an unknown modification, and it is the standard delivery vehicle for a session stealer.
- Files whose content matches a known malicious family with enough corroborating evidence to name it.
A jar called sodium-extra.jar is still identified by what is inside it. The check looks at the package structure, the metadata and the class names, and it keeps the original file name alongside so the report can show what was claimed.
What is not blocked
Optimisation and quality-of-life mods are explicitly left alone, including the ones whose names look alarming to a naive keyword match. The launcher carries an allowlist of trusted mods identified by id and content, so a mod called Krypton — which is a network-stack optimisation, and a good one — is not caught by a rule looking for client names.
If you find a mod that is blocked and should not be, that is a bug worth reporting, and the report is easy to make accurate: the flagged-mod dialog has a copy action that gives you the jar's hash, its ids and the rule that fired.
What happens to a blocked jar
- It is moved out of the instance's mods folder into a quarantine folder beside it.
- It cannot be re-enabled from the Mods page or from the right-click menu — the refusal is in the service that performs the change, not only in the button that is missing.
- The reason is shown in the flagged-mod summary, naming the family where one was identified.
If the game cannot start
A quarantined jar is never half-quarantined: the move is atomic, so there is no state where the launcher thinks a mod is disabled and the loader still sees it. If a launch fails immediately after a quarantine, the Logs page will name the jar that is missing, and the fix is to restore the file from the quarantine folder beside the mods folder — unless it was blocked for a reason you disagree with, in which case report it.