# Attention community - three.js-dev-r148 - VIRUS?

**URL:** <https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423>\
**Category:** Site Feedback\
**Created:** [March 22, 2023, 2:02am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423 "2023-03-22T02:02:56Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rozz](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/rozz/32/10744_2.png) [@Rozz](https://discourse.threejs.org/u/Rozz)\
**Post date:** [March 22, 2023, 2:02am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/1 "2023-03-22T02:02:56Z")

</div>

I am being attacked on all sides and would like to report a possible warning.

* * *

ClamTk, v6.07  
Tue Mar 21 22:55:43 2023  
ClamAV Signatures: 8674330  
Directories Scanned:

Found 1 possible threat (263523 files scanned).

## …/www/threejs-r148/three.js-dev-r148/three.js-dev/examples/textures/memorial.tif Img.Exploit.CVE\_2012\_2027-6332502-0

---

<div class="post-metadata">

**Author:** ![donmccurdy](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/donmccurdy/32/33209_2.png) [@donmccurdy](https://discourse.threejs.org/u/donmccurdy)\
**Post date:** [March 22, 2023, 3:05am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/2 "2023-03-22T03:05:31Z")

</div>

See discussion in [A virus appears to be present in this repo · Issue #25190 · mrdoob/three.js · GitHub](https://github.com/mrdoob/three.js/issues/25190) — this doesn’t appear to be a real vulnerability.

---

<div class="post-metadata">

**Author:** ![Umbawa\_Sarosong](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/umbawa_sarosong/32/30107_2.png) [@Umbawa\_Sarosong](https://discourse.threejs.org/u/Umbawa_Sarosong)\
**Post date:** [March 22, 2023, 6:36am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/3 "2023-03-22T06:36:46Z")

</div>

I don’t know if Rozz is being serious or just being hilarious, there is no such threats in threejs? I have been using threejs and I have never encounter such issues, and the way you described the issues is exagerated, (attack on all side) what is that even mean?

---

<div class="post-metadata">

**Author:** ![makc3d](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/makc3d/32/10452_2.png) [@makc3d](https://discourse.threejs.org/u/makc3d)\
**Post date:** [March 22, 2023, 10:55am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/4 "2023-03-22T10:55:28Z")

</div>

should you not then update whatever tiff files it complains about, to make sure they are not recognized as “crafted”

---

<div class="post-metadata">

**Author:** ![donmccurdy](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/donmccurdy/32/33209_2.png) [@donmccurdy](https://discourse.threejs.org/u/donmccurdy)\
**Post date:** [March 22, 2023, 1:05pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/5 "2023-03-22T13:05:25Z")

</div>

If I spent time on every reported issue in every code scanning tool, I would get nothing else done. I try to address those that represent actual problems, not the (many, many) false positives. NPM audit is a particularly bad offender here.

If you’d be interested in updating the .tif file so this tool doesn’t flag it, that’s great. 🙂

---

<div class="post-metadata">

**Author:** ![makc3d](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/makc3d/32/10452_2.png) [@makc3d](https://discourse.threejs.org/u/makc3d)\
**Post date:** [March 22, 2023, 4:46pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/6 "2023-03-22T16:46:42Z")

</div>

nah Im good. I dont have this tool installed any way. let the topic starter do the pull request then XD

---

<div class="post-metadata">

**Author:** ![Rozz](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/rozz/32/10744_2.png) [@Rozz](https://discourse.threejs.org/u/Rozz)\
**Post date:** [March 22, 2023, 5:43pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/7 "2023-03-22T17:43:45Z")

</div>

Yes, I should have researched the subject before, unfortunately my life is very busy, and the meaning of being attacked from all sides is real, mobile network, wifi and wired… I found this because I am in paranoid mode, it’s no joke.

---

<div class="post-metadata">

**Author:** ![Umbawa\_Sarosong](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/umbawa_sarosong/32/30107_2.png) [@Umbawa\_Sarosong](https://discourse.threejs.org/u/Umbawa_Sarosong)\
**Post date:** [March 24, 2023, 9:24pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/8 "2023-03-24T21:24:29Z")

</div>

My dear friend, it is best ethics to please evaluate your post before posting it, you are fortunate to have not been flagged, because your post is out of topic.

---

<div class="post-metadata">

**Author:** ![Rozz](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/rozz/32/10744_2.png) [@Rozz](https://discourse.threejs.org/u/Rozz)\
**Post date:** [March 26, 2023, 3:28pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/9 "2023-03-26T15:28:40Z")

</div>

How can I fix friend?

---

<div class="post-metadata">

**Author:** ![Umbawa\_Sarosong](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/umbawa_sarosong/32/30107_2.png) [@Umbawa\_Sarosong](https://discourse.threejs.org/u/Umbawa_Sarosong)\
**Post date:** [March 26, 2023, 9:00pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/10 "2023-03-26T21:00:02Z")

</div>

if what u said is true? then there must be another cause, it could be a plugin or something you have installed in your pc, creating a virus in javascript is impossible, a virus can only be made on a computer program such as assembly language, flash MX, turbo C and any windows application that has a .COM or .EXE extension that you may have installed in your PC

---

<div class="post-metadata">

**Author:** ![Rozz](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/rozz/32/10744_2.png) [@Rozz](https://discourse.threejs.org/u/Rozz)\
**Post date:** [March 29, 2023, 9:54pm UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/11 "2023-03-29T21:54:39Z")

</div>

So, as I sent is an ‘Exploit’ in the file ‘memorial.tif’ in the path indicated above…

It wasn’t me who warned, it was Antivirus for Linux ClamTk v6.0  
I just did what I would do as a tech person, removing the hazard and warning the community. To know how this exploit works, the interested party will have to go deeper, that’s it!

---

<div class="post-metadata">

**Author:** ![Lawrence3DPK](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/lawrence3dpk/32/29184_2.png) [@Lawrence3DPK](https://discourse.threejs.org/u/Lawrence3DPK)\
**Post date:** [March 30, 2023, 12:46am UTC](https://discourse.threejs.org/t/attention-community-three-js-dev-r148-virus/49423/12 "2023-03-30T00:46:07Z")

</div>

that’s not entirely true, **XSS** is capable of injecting javascript into a website to scrape sensitive data that may have been left vulnerable… that being said the flagged “virus” above seems to have been a vulnerability in an older version of photoshop that

> allows remote attackers to execute arbitrary code via a crafted TIFF (aka .TIF) file.

as described in this post…

> [@donmccurdy](#):
>
> See discussion in [A virus appears to be present in this repo · Issue #25190 · mrdoob/three.js · GitHub](https://github.com/mrdoob/three.js/issues/25190) — this doesn’t appear to be a real vulnerability.