Malilib.jar by sakura-ryoko has a trojan

[MykalJacsun]

Sakura ryokos malilib 1.21 sakura2 or whatever its called has a PUA virus on it wow amazing. thankfully as it is a jar the virus is not too hard to remove just perma delete the jar however it most likely copied itself to appdata so make sure to look around in file explorer for anything suspicious. would not recommend downloading any of sakura-ryokos developments.

[MykalJacsun]

the litematica jar also has a trojan

[MykalJacsun]

[mlaikofta222]

I don't think the UUID is that private - but if you're going to censor something private, make sure it's super censored.

"add???5e-5c?5-4be6-b527-???????f72"
Somewhat censored, but stay safe :)

[MykalJacsun]

the malilib jar doesnt have the trojan sorry for the incorrect title but basically the same effect

[sakura-ryoko]

It's a false positive affecting many mods, if you got it from my Github, its safe to mark it as "safe" . It does not have a "trojan" .

[MykalJacsun]

Only mods from their page triggered it out of tens of 1.21 mods I downloaded? Seems unlikely

…

On Mon, 17 Jun 2024, 6:33 pm Sakura Ryoko, ***@***.***> wrote: It's a false positive affecting many mods. — Reply to this email directly, view it on GitHub <#156 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A45XH7YC4BUJHYK54XICK4LZHZ7MVAVCNFSM6AAAAABJNJL6AKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TOOJQGYYTI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[ThirtyTwelveNor]

sounds like a you problem.
VirusTotal malilib-fabric-1.21-0.19.999-sakura.2
VirusTotal litematica-fabric-1.21-0.18.999-sakura.3.jar
VirusTotal tweakeroo-fabric-1.21-0.20.999-sakura.2.jar
VirusTotal minihud-fabric-1.21-0.31.999-sakura.3.jar

[TymonMarek]

Many Windows Defender alerts that end with !ml (Machine Learning Detection) are usually false positives. These are detections from Microsoft's AI.

[benhovinga]

All of the latest versions of @sakura-ryoko fork are flagged with a trojan on Virus Total.

I downloaded and tested the last 5 releases from their github and all contain the same virus flag Trojan.PY.Agent.AG

• VirusTotal malilib-fabric-1.21.5-0.24.0-sakura.8.jar
• VirusTotal malilib-fabric-1.21.5-0.24.0-sakura.7.jar
• VirusTotal malilib-fabric-1.21.4-0.23.3-sakura.3.jar
• VirusTotal malilib-fabric-1.21.5-0.24.0-sakura.6.jar
• VirusTotal malilib-fabric-1.21.5-0.24.0-sakura.5.jar

[sakura-ryoko]

False positives yet again.

[mlaikofta222]

"False positives yet again."

So why do many different antivirus platforms report a trojan? Only the structure of 1, maybe a couple, antiviruses might flag the same false positives. For all the innocent players out there - I'm not saying that the Trojan is real, but stay on the safer side - get the official release by maruohon. The official creator is even conveniently listed in the URL to this forum page! There's no reason not to.

Edit: Also, I am aware that maruohon stopped the updates, but would you rather have litematica and a POSSIBLE (not saying it's real, just that it's likely) Trojan horse, or neither?

[sakura-ryoko]

"False positives yet again."

• get the official release by maruohon. The official creator is even conveniently listed in the URL to this forum page! There's no reason not to.

I agree. The -sakura.X builds are only meant for beta testing, etc; and people should be getting them from the Official Modrinth pages after I upload them; or whenever Masa uploads them to his Curse Forge page on occasion.
Technically speaking; the -sakura.X builds are also "Official" from my Github only. If they appear anywhere else; they should be checked by Hash Code or downloaded from my Github.

I often tell people to go and check the code if they don't agree or build them yourself from my Github if you don't trust my builds for whatever reason; or find the "Virus" in the source code.

[mlaikofta222]

Not accusing you - just trying to stay safe. Sorry, please don't be offended :)

[sakura-ryoko]

Not accusing you - just trying to stay safe. Sorry, please don't be offended :)

Part of what's happening is people's web browsers are using AI to "scan" files and often flag items that it doesn't recognize; or if people "re-post" my code with something that shouldn't be there. If the files are not named with the Official naming conventions; that will be a clear sign that someone modified it; or checking them by Hash Code.

[mlaikofta222]

Also, 0.27.3 isn't flagged - just the newest ones.

[sakura-ryoko]

Also, 0.27.3 isn't flagged - just the newest ones.

There seems to be no rhyme or reason to it. I can build them exactly the same way and one might get flagged; and the other won't. It doesn't matter if I use the build script or build them on my computer; or my work computer; the same can happen.

[TymonMarek]

If you would like to test this yourself, you can diff the release before Windows Defender marked it as a trojan and the release in which it started happening. This will show you what was added in that release and therefore what Windows Defender may be flagging as "malicious behaviour".

I feel like this issue should be closed since it is not a real issue per-se.