I did some investigating, and what they're doing is not allowed:
They're asking users to input their credentials into their 3rd party launcher. Mojang doesn't want this because of security.
They're rehosting the Minecraft libraries and game on their own server. That's illegal.
They combined all the mods into a a single JAR with the actual game, and put it up on their server. That's also illegal.
They even re-obfuscated the Minecraft source code...
If you were using that launcher, you should stop doing so.
They're not using Forge, so I don't think the Forge team can do anything about it, but Mojang should really be after these types of launchers.
What you can do is something similar to what the Twitch launcher does. The launcher downloads the mods (don't package them in the launcher!!!), and open the vanilla launcher with the path to the profile folder.
Then again: is it really worth it? I imagine it's way easier to upload a modpack to Curse and have the users install that...