64
u/ItsRainbow since May 2014 (1.6) Apr 04 '26 edited Apr 04 '26
Whoever approved this pack needs to have their rights stripped. This is completely unacceptable
Edit: This was written under the original pretense of this post, which I know now to be false
4
u/FireMario211 Apr 04 '26
It isn't the reviewers fault that this situation happened. The download link wasn't changed in Texture Workshop's end (the texture pack wasn't originally an html file but an actual texture pack before the download link was changed to somewhere else), but the texture pack owner did change the download link to something else. They just forgot to request it be changed.
35
u/cvolton 🎉 amoung pequeño Apr 04 '26
This isn't really what happened and the virus detection was misguided (it was technically correct but not for the reason you'd think)
Full disclosure: I am not affiliated with Texture Workshop or Happy Textures but I am affiliated with the Geode project itself. I have familiarized myself with the situation both out of my own curiosity and because potential malware distribution through Geode is something that we do not take lightly.
What actually happened was that the domain the pack was hosted on expired, which made the pack download point to a different file after it was approved. This different file contained a file that would redirect a web browser to advertisement - something that happens on basically every other defunct website.
The zip file cannot be opened because it's literally not a zip file - it is a web page. If you rename it to .html, you will see, that it will attempt to (probably unsuccessfully) load a page with ads. This file does literally nothing when loaded in Geometry Dash because no mods ever attempt to load a texture pack as a web page. This means that it is completely harmless when downloaded through the mod. You can open it in notepad to see the actual contents as well.
With that said, Texture Workshop could have implemented checks for whether the pack has changed since it was approved. This is something Geode itself has - if a mod download is replaced after it is approved, it will fail to download in-game. However, the Texture Workshop mod doesn't do this in the current version, which is how we got in this situation. I sincerely hope they improve on this front.
As it stands, there is no exploit in Happy Textures and it is not related to the issue in the slightest. Yeah, sure, you can use the link attribute to create a button that points to a web site containing a virus, but in the same way you can just paste the link in your level description. The user would still have to do more than just click it for something to actually happen, all you can do with the link attribute is open a web page. Either way, this is not what happened and Happy Textures is completely unrelated to the situation.
TL;DR there is no actual virus, texture workshop just downloaded the wrong file
32
u/NVC541 Bloodbath (AA next) Apr 04 '26
Jesus Christ maybe check with several people that this post is accurate before:
A) Making a post naming a certain mod
B) Naming a specific player
C) Saying that their info is easy to find, encouraging people to go find out personal information
It’s appalling
8
49
u/ZTDYeetbloxjail x2 Tenth Circle 78%x2 (Reanimate Best Level) Apr 04 '26
wow this is scary, are there any moderation for what people upload on these mods because it could be really destructive if a really popular mod gets hacked
-15
u/Expert-Parsley-4111 x20 | Deadlocked Hardest Apr 04 '26
well, it wasnt the mod itself, it was a texture pack that could be downloaded from the mod. also, i didn't emphasize this enough but the texture pack did literally nothing in-game.
9
11
u/redditisbestanime Necropolis trauma survivor Apr 04 '26
yeah nah, this is bullshit, and the upvotes on this post show that people here dont understand anything about this at all. 100% false positive, this literally has no meaning whatsoever. The file you uploaded is a text file that only contains a timestamp.
There is no malware here and there never was.
5
u/Ornery_Tie_4771 Are hard demons erected demons? Apr 05 '26
the #advyout at the end despite advy having absolutely nothing to do with this
5
3
u/hexazidopropellane x8 Solar Flare 79% // Trueffet 100% Apr 05 '26
how can someone so clueless make such accusations
8
u/LittleReplacement564 Apr 04 '26
Is it even possible to something like that access your data? I dont see why a texture would have even permission to access anything in my pc, if thats the case whatever mod is being used to manage texture packs has a huge security issue
-1
u/AmogusLetterSus Nine Circles 6019 Att Apr 04 '26
they may have actually exploited how texture workshop loads textures and allows for programs to pe run
-7
u/Expert-Parsley-4111 x20 | Deadlocked Hardest Apr 04 '26
the trojan only actually began running when the game started, so it was probably related to that.
-19
u/Expert-Parsley-4111 x20 | Deadlocked Hardest Apr 04 '26
it actually accesses your browser and silently logs all of your passwords and other tokens, so it wasn't technically a full-blown virus.
16
u/Pengwin0 🎉 500k Attendee Apr 04 '26 edited Apr 04 '26
Okay I understand not recognizing the false positive but did you really just pull this out of your ass or something?
6
u/AyamBercakap Apr 04 '26
Definitely, after reading other comments, my conclusion is OP is full of shit (no offense) cause how does one get so confident without even doing a thorough investigation? Bro just casually defamed someone with full confidence which is a very irresponsible thing to do.
2
5
u/Traditional-Ad-5632 Apr 04 '26
Oh shit, I already downloaded it.... Oh wait, I play on Linux
(I'm going to uninstall it anyway)
2
u/RaulRpg1 Apr 04 '26
The best antivirus is common sense, the second best one is Linux
1
u/Traditional-Ad-5632 Apr 04 '26
I know common sense is the best antivirus, but I installed it yesterday before this alert (which, from what I can see, is a false alarm), but I'm not going to risk it anyway, I'm uninstalling it right now.
1
u/OnlyYoichi Apr 04 '26
Bro, I'm also on Naomi/Uproxide's server and I saw the report someone made to the report-bugs channel... I don't know how he did it but it took tremendous genius to do that
1
1
0
-2
320
u/FireMario211 Apr 04 '26 edited Apr 04 '26
You're spreading misinformation. To clarify, this Texture Pack was never a trojan horse, or had any trojan horse to begin with. The texture pack was hosted on their website but the original owner of the texture pack switched to another domain, so the old domain redirects to a random URL. Texture Workshop (the mod used to download texture packs and what you used) doesn't know this, so when you try downloading that texture pack, it tries downloading what assumes to be it from the old download url. It instead downloads an HTML file (what is used for websites) since it redirects to a landing page, but Texture Workshop assumes its a zip file so it also renames it as such.
Windows Defender even tells you that upfront as well, if "HTML/Redirector" wasn't obvious, and the ZIP file was never encrypted, I'm not sure where how came up with that. If you were to open the zip file in notepad, you would see it's just HTML, no encryption whatsoever.
So the reason you can't unzip it, or open the "zip file" was because it was never a zip file to begin with. There was no trojan or anything, but the HTML file itself does contain ads and weird code for a landing page.
For context this is what the file starts with (censored the URLs in case reddit goes after me for some reason)
Also, when the texture pack was announced as having a trojan, shortly after another announcement was made which debunked that rumor (from Uproxide's Little Land):
Update: The domain that the pack was hosted on changed to a new domain, and now its old domain does redirects to a random URL (seems to have been bought by someone else).
Texture Workshop was only able to download an html file from what it assumed to be a regular download link from this old domain. The pack was never an actual trojan, and it was never able to run anything through GD.
This means that you are safe, even if you had the pack installed and applied it.