A malware loader, “GodLoader,” has been found exploiting the Godot runtime. This highlights the importance of only downloading software from trusted sources.
Full details: https://godotengine.org/article/statement-on-godloader-malware-loader/
@godotengine Okay, I read that entire CPR report. From what I understand the big issue they have is that one can replace the .pck file of a game with malicious code. How is that different from running any suspicious executable off the internet? You can swap out files in *any* program to run malicious code.
Their conclusion of "everyone using Godot programs is potentially under attack" is insane. Anyone downloading anything off the internet is potentially under attack. Or am I missing something?
@popcar2 @godotengine There's a very long history of 'security' companies putting out panic pieces like this that essentially boil down to "the thing that is designed to run code, can also run malicious code if you download that" despite it not being a remotely new technique. It's a marketing tactic, trying to market themselves as "the company that found the new thing".
The only real 'insight' here is "this file type can contain executable code". Which isn't *useless* information, but also not really deserving of any more mention than a line on its Wikipedia page or, in this case, a warning on mod portals...
