Basically the only malicious thing it would be able to do that would not require user-interaction would be overwriting Blockland.exe (which would make it run the malware on user-launch), but since that is verified by the launcher when you launch it, it can't really do anything harmful (except if you're running multiple instances and some very specific timing happens). And I'm not sure about whether BL holds a mutex lock for writing on BL.exe (which would negate this issue).
write 1,000,000 files with 1,000,000 lines of uselses bullstuff. You can take up gigabytes if you plant it carefully.
It would also be very slow.
But then wouldn't the person have to download this gigabytes of crap?
No, the script would generate the crap while doing it.
On the other hand we have Minecraft mods which generally run as regular Java classes, meaning they can do pretty much anything any other application can (including executing stuff).
