[Bug]: Threat “EXP/Agent.EB.45” in libnextcloudsync.O.dylib of Mac client version 3.12.1

[chadchr]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

My Avira antivirus reported a threat of “EXP/Agent.EB.45” in libnextcloudsync.O.dylib when I tried installing Mac 64bit universal client version 3.12.1. I deleted that version and went back to 3.12.0 without any issues.

Steps to reproduce

1. Install Mac client version 3.12.1

Expected behavior

I would expect my Antivirus not to report an issue.

Installation method

Community Web installer on a VPS or web space

Nextcloud Server version

26

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

See https://www.reddit.com/r/NextCloud/comments/1b90v2x/threat_expagenteb45_in_libnextcloudsyncodylib_of/

[pck1980]

At VirusTotal, a total of 4 scanners detect a threat in the macOS pkg file:
https://www.virustotal.com/gui/file/6ac78e22c57c13884328f06deded69c75a157dad2f4349eb50b283b970bbf3fa

As this is likely a false positive, it would perhaps help to submit the suspected file to Avira for further analysis.

[pck1980]

Avira on VirusTotal no longer flags the pkg as infected. From the four engines I mentioned above, only two remain.

[joshtrichards]

Only one remains at this point.

I'm not going to install a random virus scanner to get more details. :-)

If someone uses the one in question, they can report it as a false positive (or maybe provide more details about what it has a problem with).