add malicious loose file to blacklist

Author: Pathoschild

docs/release-notes.md

@@ -6,6 +6,7 @@
   * SMAPI now uses [automated and attested builds](https://www.patreon.com/posts/automated-builds-148417912) (thanks to DecidedlyHuman)!  
     _This improves the security and transparency of SMAPI builds. Every step to build SMAPI from the public source code is now public and verifiable, with file signatures to let players and tools confirm the build hasn't been tampered with._
   * SMAPI can now detect known malicious loose files in the `Mods` folder.
+  * Updated internal mod blacklist.
 
 ## 4.4.0
 Released 10 January 2026 for Stardew Valley 1.6.14 or later. See [release highlights](https://www.patreon.com/posts/147916705).

src/SMAPI.Web/wwwroot/SMAPI.blacklist.json

@@ -21,5 +21,11 @@
      * If any file in a folder matches an entry, the entire folder is considered malicious.
     */
     "LooseFileBlacklist": [
+        // 2026-01: 'Alchemistry' (ModDrop:1731397, malicious reupload of legit mod)
+        {
+            "Name": "Auto_Alchemistry.bat",
+            "Hash": "8b749727775689a05cc92ab4d624ab8b",
+            "Message": "It downloads malicious code from a remote server and runs it on your computer. SMAPI refused to load the mod, but you should delete the mod containing this file and run a complete anti-malware scan of your computer now to be safe."
+        }
     ]
 }