Hey my browser is saying the 7z file is dangerous.
This isn't a proper virus scan. This is from the datanodes URL.
I don't believe my browser(Brave) has a proper antivirus scanner so likely a false positive but it's the first time i've seen it, even on f95
Last edit
I have done an audit on the files. It's likely a false positive. I suspect my browser has datanodes black listed which is what caused me to make this post. I think the upload is safe but i'm not 100% certain.
I was able to download the file with
no issue from Pixel Drain. i confirmed what i downloaded and what my browser didn't like were exactly the same.
I have checked the edited files in the game from base japanese version, doing my best to ignore obvious false positive like everything in /data/ folder focusing on html and javascript files. The only things i'm unsure of is 2 plugins added in this version which obviously relate to translation. They're big files and my javascript isn't exactly sharp so an audit would be pointless by me. Given the reasonable explanation for why the file was flagged and the lack of evidence of danger, i'm assuming false positive.
I put this latest edit first, but all my previous edits are in order afterwards in case you want my details how i came to these conclusions or wanted to audit the files yourself.
Edit
I redownloaded the game from pixeldrain link provided in the thread. My browser isn't complaining. What i noticed is that Datanode use the URL
You must be registered to see the links
which is likely a redirect with information passed to it for what file you want. Malicious actors might have used datanodes to upload malware or something, and brave has a database of malicious URL. The two match for obvious reason. I'll do a bit more investigating
Edit Edit
the uncomfirmed.*.cdownload was the bad file. the 7z file is the pixel drain version.
So i have confirmed both files are the same so i'll be using the pixel drain version.
EDIT EDIT EDIT
So i had a jap version to compare to files so i just used diff and figured out which files are changed.
Obvious data files are changed (You would hope so), but there were some changes to actual code files. Not exactly what i'd expect to be detected.
Index.html: simple changes the name on the titlebar
js/plugins.js: CustomTranslationEngine & MessageFontSize added to the plugin list.
js/plugins/CBR_EroStatus.js: changes sending a number to RPGMaker engine to sending a number to the engine with a bool. (looks normal and might be game version diff)
/js/plugins/TMMenuLabel.js: changes sending a number to RPGMaker engine to sending a number to the engine with a bool. (Same 1 line change)
The other 2 plugin files
CustomTranslationEngine & MessageFontSize are added in, so they aren't easy to check. I can kinda read JS but we're talking about about file that start off with 2k lines of comments, and i'm sure the lines of code are longer.
I believe what i reported is a false positive.
The fact Datanode.to the site i downloaded it from uses the same URL for all files likely resulted in false report.
Every non-data file checked that had changes were cosmetic to minor. The only exception were 2 plugins added which would be expected for professional feeling translations work.
I don't have the time or energy to do a 6k+ code audit but i very much doubt whatever file checker is in a browser would be smart enough to unzip a 7z file, and be able to parse javascript code looking for something malicious. The fact i was able to download the exact 7z file from another website proves this fact.