Threat secured in snowflake firefox add-on

Hello onions, i have the Snowflake Add-On active from a lot time but today i received an Avast alert as you can see in the following image, can somebody say me what’a appen? I disabled SnowFlake in this moment.

1 Like

It’s a false positive. Accessing this URL is a normal part of Snowflake proxy operation. You should allow it. Even if the URL were to turn evil, it can’t do direct harm to your PC, based on how the Snowflake extension is programmed.

Would be interesting to know how it turned up on the blacklist though. Here’s the VirusTotal’s one.

I’m not a conspiracy theorist but I honestly wouldn’t be surprised if avast was paid to do that

1 Like

There has been a similar false positive in the past, specifically with Google Safe Browsing and Malwarebytes. The Snowflake bridge and broker used to run on snowflake.bamsoftware.com and snowflake-broker.bamsoftware.com, and an unrelated web page got the whole domain marked as malware in some antiviruses. We moved the domains to snowflake.torproject.net and snowflake-broker.torproject.net though, so the presence on an Avast blacklist may be new.

4 Likes

Also see an issue on GitLab: