The only thing VirusTotal would tell you about, is already known patterns of virus/malware. If there is a novel/different way of doing something, and/or it hasn't been noticed by the AVs they're collaborating with, you'll end up with everything green.

PoC Rust program that takes the contents of .npmrc and uploads it to a random IP (DONT RUN THIS! It'll steal your npm authentication token): https://gist.github.com/victorb/adf0ac8b7ada8d5a4982462e24e8...

"No security vendors flagged this file as malicious" = https://www.virustotal.com/gui/file/b99b86a5ce3aa24b39ec53dd...

But clearly, it is malicious :)

I don't understand, the op claims the alert came from Virustotal.

I think he might be talking about the "relations" tab. You can see the "Contacted IP addresses" section that claims to be "contacted IPs by the file uploaded to virus total". If you click the IP some will have detections and flagged as bad or criminal.

https://www.virustotal.com/gui/file/dcca6afb6ac9770d4d3425c3...

Says it contacted 45.66.35.11 and you can see its a tor relay https://metrics.torproject.org/rs.html#details/7EA6EAD6FD830...

Though haven't looked at how yt-dlp works, I'd guess yt-dlp might attempt to use tor network in case some IP or network is blocked and can't reach a server.

Its not just a tor relay, it is one of the directory servers: https://metrics.torproject.org/rs.html#search/flag:authority

Look at other tabs https://www.virustotal.com/gui/file/3f6ab524d899f39ef46004a9... at the bottom you can see the commands that looks like the program trying to delete down syslogs. Look also in the relations tab that shows some tor nodes.

This is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process.

I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.

You mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself

Why would yt-dlp tell syslog to reload?

It seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs.

And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?".

If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.

I don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?