KhronosGroup/glTF-Validator

Malware detected in compiled CLI tool

akiesskp opened this issue · 5 comments

I compiled the CLI tool today, and in the process of copying it to another machine discovered it is flagged as containing malware.

GoogleDrive/Gmail will not allow downloading the exe due to detected malware, and both VirusTotal and MetaDefender have flagged it as containing trojans.

Are these known issues?
https://www.virustotal.com/gui/file/c18eaf796e07c4789f45bb3f4601d1ff8b2b35d849ce722995c42dd14134ba8d/detection
https://metadefender.opswat.com/results/file/31c4028bc46766d02bfb19607a6bc276/hash/multiscan?lang=en

I have confirmed that compiling the exe on a different, isolated machine produced the same thing.

We certainly did not have any problems like this before. What branch from this repo and what Dart SDK version were used?

I used the tip of master, and Dart 2.12.4. If you upload the generated CLI exe and check it against those scanners do you see the same issue?

Yeah, I see similar results with 2.12.4. Compiling with beta SDK (2.13) doesn't trigger those detections, though.

I can try that, thanks.

edit
That works for me too.

The issue seems to be resolved with SDK 2.13.