search

patterns-ai-core / langchainrb

Build LLM-powered applications in Ruby
https://rubydoc.info/gems/langchainrb
MIT License
1.19k stars 157 forks source link

Trojan detected #683

Closed mazenkhalil closed 1 day ago

mazenkhalil commented 3 days ago

The following file has been detected as Trojan!

spec/fixtures/loaders/clearscan-with-image-removed.pdf

image

andreibondarev commented 3 days ago

I'm really doubtful that @rickychilcott would've added this file with a malicious intent.

I ran the local file through VirusTotal: https://www.virustotal.com/gui/file/9d8e3994e70d41ebc1bb0ecdb0fdaf133c0d6701f743e933f9666b9f40faa4e7.

mazenkhalil commented 3 days ago

It has been detected by Norton on Mac OS. I have submit the file for further analysis.

image

rickychilcott commented 2 days ago

Definitely not intentional if there is an issue there. I can't remember where I sourced this file, but if I remember correctly, I think I found a set of "pdf samples" from a university. But I can't be sure and can't find them with a Google search.

I must admit, I'm not feeling very confident about the file source.

I did try that file on VirtusTotal - see the scan results for clearscan-with-image-removed.pdf and https://internxt.com/virus-scanner and both seem to say it's not an issue. But... they might not have the malware signatures in their database.

These can be swapped easily if there is concern and I apologize if there is indeed an issue.

andreibondarev commented 2 days ago

@mazenkhalil Could it be that your local copy of the file is compromised? I would try pulling it down again and running through a scan.

mazenkhalil commented 2 days ago

I have just pulled a new version from the repository, and the file has been immediately quarantined. As I mentioned earlier, I have submitted a report to Norton for further analysis. Whether the file is actually infected or it is a false alarm, I recommend acting quickly and replacing it with something else.

image

andreibondarev commented 1 day ago

@mazenkhalil I went ahead and swapped it out. Thank you for flagging this!