Flagging an extension with malicious code

Hi, I spotted an extension with malicious code, where is the proper place to let it be known by extensions administrators? The releases say that it is from 2016, but also in the page it says that the latest release is from 3 months ago.

I guess that it would be good to have the md5sum of the latest uploaded version somewhere in the page.

Contact with the extension maintainer would be via comments, with platform admin here. What extension do you think behaves wrong and why?

MD5 sounds not too complicated but I cannot see why this could help.

1 Like

You are right, for the particular case it directly does not help. It would only be useful for letting know that the oxt file being revised is the one present in the platform.

I double checked and it was a misunderstanding on my side. I just saw this code, and did not took a look in depth localpath variable value.

def cleanup():
    
    files = glob.glob(localpath + os.path.sep + '*')
    for f in files:
        os.remove(f)

Thank you for doing the extensions and maintain all the infrastructure for the team.