Is it possible to spread malware through Minecraft Servers? How likely is it?

I asked an expert on this and many more Minecraft related topics (Pokechu22) and this is what they answered:

Answer: No, excluding resources downloaded (resource packs and skins), which still will not be executed without the user manually doing something stupid (in which case, you can just as easily pwn them by making them download some other malicious executable). Vague link to https://wiki.vg/Protocol.

Java makes it unlikely for buffer overflows leading to arbitrary code execution or similar issues to cause problems; if there was a problem then it would affect far more than just MC.

The link about malicious plugins is a thing, but that's more the server owner installing arbitrary plugins that do bad stuff to that server than harming clients

I can't speak for bedrock. That could have buffer overflows or similar issues for all I know.

(and, in case it matters, I give permission for you to quote these comments there and apply the needed license for stackexchange posts, etc)

Oh. And since that question was about one user spreading stuff to other users, the only venue is skins (which now have a lot of filters on them to prevent embedding files after the PNG data, but in the past didn't, leading to a scare -- though again that was NOT executed by the game. Such attacks shouldn't be possible/would be much harder now, since skins are recompressed and sanitized by Mojang)

The only other venue through which malware could spread is chat, since chat gets sent between players and is logged. So you could put something into chat, but that still wouldn't be executed. Or you could put a malicious link in chat, but that'd require naïve players anyways.

You could send the EICAR test file in a chat message, but that wouldn't be executed (and isn't considered a threat if it's a substring, only if that's the file's whole contents; after all, it's not executable as-is)

And it's not like that's limited to MC's chat; I can send it right here too: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*