Search Unity

com.unity.mathematics flagged as containing malicious code

Discussion in 'Package Manager' started by elZach, Jun 21, 2022.

  1. elZach

    elZach

    Joined:
    Apr 23, 2017
    Posts:
    48
    elZach, Jun 21, 2022
    #1

  2. fherbst

    fherbst

    Joined:
    Jun 24, 2012
    Posts:
    802
    fherbst, Jun 21, 2022
    #2
    LeonhardP likes this.

  3. LeonhardP

    LeonhardP

    Unity Technologies

    Joined:
    Jul 4, 2016
    Posts:
    3,136
    Thanks for flagging. I've forwarded it to the team.
     
    LeonhardP, Jun 21, 2022
    #3
    fherbst and Noisecrime like this.

  4. Noisecrime

    Noisecrime

    Joined:
    Apr 7, 2010
    Posts:
    2,054
    May I request you keep us updated in this thread or a new sticky.

    I've seen another report for the same issue regarding unity.postprocessing package, and others, so clearly this seems to be a wide ranging, possibly all Unity packages issue, at least with regards to github. Hopefully its just a false flag that Unity needs to get github to address, but if not then it might be something far more serious.

    Either way I feel after the recent issue with the Unity Hub and NPM we deserve to get some meaningful feedback on what has happened once Unity has investigated and sooner rather than later.

    Thanks

    Edit: mOnsky seems to have more details of the problem, that suggests its a false flag due to someone 'impersonating' unity package names and thus getting them flagged. Obviously needs further investigation but might be a useful starting point.
     
    Last edited: Jun 21, 2022
    Noisecrime, Jun 21, 2022
    #4
    m0nsky and elZach like this.

  5. m0nsky

    m0nsky

    Joined:
    Dec 9, 2015
    Posts:
    257
    Not knowing there was a specific package manager sub forum, I've posted some additional information over here that might be useful.
     
    m0nsky, Jun 21, 2022
    #5

  6. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,674
    We are still investigating, but from what we can tell so far, somebody published malware on NPM named after official Unity package names (like com.unity.mathematics). Since Unity doesn't use NPM, these names were available. And since, again, Unity doesn't use NPM, you won't pull in the "malware versions" into your project unless you try to install them via npm command line manually. Since Unity package manager uses the same .json format as NPM, it's getting flagged because it thinks the package will be installed from NPM (even though it won't as NPM isn't used by Unity). We will have more information available soon.
     
    Tautvydas-Zilys, Jun 21, 2022
    #6
    MegamaDev, NotaNaN, HIBIKI_entertainment and 4 others like this.

  7. DetroitBrian

    DetroitBrian

    Can't spell "Community" without "Unity"!

    Joined:
    Oct 17, 2019
    Posts:
    21
    Hello! As @Tautvydas-Zilys mentioned, we have become aware of some instances of rogue community packages with malicious payloads appearing on npm (known as a ‘dependency confusion attack’, which you can read more about here if you’re interested). It is important to note that these are not official Unity packages, rather packages from other developers in the community that we’ve identified as being positioned as legitimate packages from Unity in hopes of tricking users into installing them.

    At this time, our security response team is working with npm to have these malicious packages removed. Npm has also been proactive in removing the malicious packages that they have identified. We have also become aware of some dependency checker tools (such as Github’s tool and Snyk), that are identifying false positives, and are working to get those fixed.


    We recommend that users always verify the source of any third-party or community-made packages before installing, and to exercise caution with any third-party packages. We also recommend that you pin official Unity versions of packages to ensure you are always getting updates from official sources.


    We will update this thread when we have more information. Thank you!
     
    DetroitBrian, Jun 21, 2022
    #7
    Kirsche, angrypenguin, NotaNaN and 7 others like this.

  8. fherbst

    fherbst

    Joined:
    Jun 24, 2012
    Posts:
    802
    fherbst, Jun 27, 2022
    #8
    m0nsky likes this.

  9. luisfinke

    luisfinke

    Joined:
    Dec 2, 2017
    Posts:
    8
    We noticed something strange in our executable. Could be nothing but could be related. The "Input_CUSTOM_GetKeyDownInt" method was throwing an exception. The reason this seems strange is that I wouldn't expect a built-in unity method name to contain "CUSTOM" text. Is this normal or does this seem suspicious?
     
    luisfinke, Jul 6, 2022
    #9

  10. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,674
    It's normal. That function is part of the engine C# <-> C++ glue.
     
    Tautvydas-Zilys, Jul 6, 2022
    #10