Yesterday I downloaded SupportBoard v.3.5.1. but package came with a trojan-virus (Script-Ulthar.A!ml) detected first by Google Chrome during the downloading process and then by Windows Defender when I scanned my desktop; this issue was reported to the author who denied responsibility. Below is the report (apparently the file infected in the zip was supportboard/js/admin.js):
Windows Defender is notorious for false positives. What it claimed it found in your case was a “trojan downloader” in the form of a JavaScript file, rather than a trojan itself.
for security don’t open the theme file – instead, head over to virustotal.com and upload the zip file. They will scan it against all the top antiviruses and you can determine if it’s a false positive or not. if it is infected, delete the zip file and send the virustotal results to envato support by opening a Help ticket .
The !ml at the end of the trojan name means the detection is a best guess by a “machine learning” algorithm, rather than an actual known trojan. Paired with the file extension of the alleged trojan (.js) makes this a clear false positive, and it’s safe to ignore. I see these all the time, they’re quite annoying and in the cases I’ve seen are also never correct.
For a more technical explanation: The JS file will only execute in the context of a web browser. It’s not impossible for a JS file to act as a trojan within a web browser, but this would require a “zero-day” exploit for your browser, worth tens if not hundreds of millions of dollars, and would be patched immediately upon discovery. It’s not something you will find in a random theme.
Many thanks for your quick response, I will check with the online tool pointed out. As I mentioned below, I will consider this alert as a false-positive case.