Malware detection flagged "Resource Search" plugin

GSoC Projects Plugin Ecosystem Security
1

Today 8/7/26 Linux Malware Detect (Maldet) flagged a phishing-related file inside my Joplin backup profile in the "Resource Search" plugin and moved it to a quarantine directory. Maldet has not previously detected any malware on nightly runs over the past 8 months, so this was a first. For safety, I thought I should share this.

Best regards, Sean

Here is the message from maldect...

"FILE HIT LIST:{CAV}Html.Phishing.SVGDynamicFunction-10060409-0 :+/home/falstaff/JoplinBackup/default/profile/plugins/net.rmusin.resource+-search.jpl =>+/usr/local/maldetect/pub/falstaff/quar/net.rmusin.resource-search.jpl.2+994018426

==================Linux Malware Detect v1.6.6 < proj@rfxn.com >"

What an AI inquiry noted...

.../JoplinBackup/default/profile/plugins/net.rmusin.resource-search.jpl: The extension .jpl stands for Joplin Plugin. It appears the malware signature was packaged or embedded directly inside a community-developed/third-party Joplin plugin named net.rmusin.resource-search.

Potential Context: True Positive vs. False Positive

  1. True Positive (High Likelihood): The plugin repository or the developer's account might have been compromised, causing a malicious update to be pushed out...(snip)
  2. False Positive (Moderate Likelihood): Maldet signatures can sometimes trigger a "false alarm" if a legitimate code snippet inside the plugin uses an XML or Javascript framework that mirrors the dynamic structure found in SVG phishing kits.

For safety, the following actions suggested by AI were performed...

1. Fully Quit Joplin

Do not just click the close "X" window button.

  • Via the Menu: Click File > Quit (or Joplin > Quit on a Mac).
  • Via the System Tray: Look at your taskbar/system tray near the clock. If you see the Joplin icon, right-click it and select Quit. [1]

2. Verify the Actual Plugin File is Gone

Since you are dealing with a malicious signature, manually verify that Joplin successfully deleted the primary copy of the plugin file from your active profile (not just your backup folder):

  • Open a terminal or file manager and navigate to your live Joplin configuration directory:
    ~/.config/joplin-desktop/plugins/
  • Look for net.rmusin.resource-search.jpl. If it is still present in this directory, delete it manually.

3. Clear cache and restart

Once you have verified the file is gone and the application has completely closed, open Joplin again. The "Resource Search" action should now be entirely missing from the Tools menu.

2

This is two pages of llm nothingness to be honest. What specific part of the plugin is supposed to be malicious? Isn't the scanner giving more information?

3

The scanner does not provide more info, but below is additional AI output about the signature the scan detected. (Highlighting is not mine.)

Html.Phishing.SVGDynamicFunction-10060409-0 is a security detection signature for a malicious SVG (Scalable Vector Graphics) attachment used in credential-harvesting phishing campaigns. These attacks embed obfuscated JavaScript inside image files that automatically execute when opened in a web browser to redirect users to fake login pages. [1, 2, 3, 4, 5]

Attack Mechanics

  • File Vector: Uses a .svg file attachment, often disguised as a document preview, receipt, or voicemail notification.
  • Execution: Browsers natively render SVG files and run internal scripts automatically without warning the user.
  • Obfuscation: Code is frequently hidden using base64 encoding or XML CDATA blocks to evade standard email security filters.
  • Payload: Redirects the browser to an external site designed to steal usernames and passwords. [1, 2, 3, 4]

Recommended Actions

  • Isolate: Disconnect the affected system from the network immediately if the file was opened.
  • Scan: Run a full anti-malware and antivirus scan using your endpoint protection tool.
  • Credential Reset: Change passwords immediately for any accounts accessed or typed into a page launched from the file.

Hope that helps.