Minecraft Malware Spreading Through Mods, Plug-ins
A worm virus called "fracturizer" has been embedded in modpacks from various sites, including CurseForge and CraftBukkit.
It seems to have been mostly an issue with curseforge. I moved away from their tools to using modrinth as the source for my 1.20 mod updates. But yes, always be careful out there.