Comment by oefrha

> A CDN compromise or cache poisoning is not out of the question due to Curse's usage of the extremely outdated and insecure MD5 to verify downloads.

If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.