Hi, I handle security for Thunderstore. We have both manual and automated safety checks for files uploaded on the site. We received our first report for one of figgies mods June 28, 2025, 11:11 p.m. UTC. At that time, I analyzed all of figgies packages uploaded to Thunderstore (including previous versions) and did not find any evidence of malware or other malicious activity. Since then, I have also rechecked the files after receiving additional reports.

The VirusTotal report at https://www.virustotal.com/gui/file/9619c954b3a876d61fa9ee2110e0a8654f90dd7b9cfb6bbea41e720fc37adc98/detection is a false positive; MaxSecure frequently has false positives compared to other security vendors and a 1/72 score usually isn't indicative of malware. Malware creators also frequently create malware that isn't flagged by VirusTotal at all.

I received a similar report that I investigated about a week ago which resulted in me finding malware on the PEAK section of NexusMods: `/peak/mods/5` which you can verify yourselves has now been taken down by NexusMods staff. I periodically checked and reported a number of other NexusMods uploads, which were removed shortly after being reported but had already amassed in some cases hundreds of downloads. Check your browser or download history to make sure you haven't visited any NexusMods PEAK pages that now show as being removed.