Malware scanner for unitypackage files

[GoatonicReal]

thanks for this man!

[GoatonicReal]

oki just used it and saw the Bvnny model i grabbed is at medium

[anonberry]

@GoatonicReal share the report

[GoatonicReal]

@anonberry still new with stuff here so i'll copy and paste

======================================================================
vrcstorage-scanner — Batch Scan Report
Generated: Wed, 29 Apr 2026 13:34:05 +0000
Files scanned: 1

SUMMARY

Score Risk Level Sanitize File

---

95 MEDIUM no BVnny_v1.4.unitypackage

======================================================================
FILE 1/1: C:\Users-----\Downloads\BVnny_v1.4.unitypackage

SHA-256 : ee96ffbda8bd78240d2a3c421a5734922f42a5cf5379f41c92f0ecbd9408fecf
Size : 385.2 MB
Score : 95 | Risk: MEDIUM | Duration: 6.78s | Action: ManualReviewRecommended
Assets : total=403 scripts=0 dlls=0 textures=105 audio=7 prefabs=26

FINDINGS (19):

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Brown_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Grey.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Brown_alt_rim.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Brown_alt.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Grey_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Black_alt_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Brown.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Grey_alt_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Black_alt_rim_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Brown_alt_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Black_alt.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Grey_alt.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Grey_alt_rim.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Black.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Brown_alt_rim_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Grey_alt_rim_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/No SPS/BVnny.Base_Black_NO.SPS.prefab
Context: count=27

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Dependencies/BVnnyBase/Prefabs/BVnny.Base.prefab
Context: count=29

[LOW + 5pt] Prefab references an unusually large number of scripts (PREFAB_MANY_SCRIPTS)
File: Assets/BVnny/Prefabs/BVnny.Base_Black_alt_rim.prefab
Context: count=27

VERDICT: REVIEW RECOMMENDED — moderate concerns, trust the source before installing.

======================================================================
OVERALL RESULTS

Clean : 0
Low : 0
Medium : 1
High : 0
Critical : 0
Sanitized: 0

vrcstorage-scanner by SummerTYT

[GoatonicReal]

now i just need sanitize it

[GoatonicReal]

uhmm- its not giving the opt to do so ~w~"

[anonberry]

@GoatonicReal where did you get the file?

[PanConChancho]

@GoatonicReal looking at that report, the file looks clean, just a lot of advices but nothing bad

[GoatonicReal]

@anonberry i got it here https://forum.ripper.store/topic/32597/lf-bvnny-by-basedvulpine/40?_=1777440297583

[GoatonicReal]

@SummerTYT ahh oki i see,so its fine just be careful basically?

[PanConChancho]

I've already updated the program; there are now fewer false positives compared to version 10 of poiyomi. I've also added a command to export a ".unitypackage" as a folder/zip file.

I also fixed the problem where the version wasn't displayed correctly when using the program (thanks @anonberry).

https://github.com/vicentefelipechile/vrchat-scanner/releases

---

Those who know how to use the terminal can extract the Unity packages; I will include an interface for this soon.

[PanConChancho]

@GoatonicReal Usually when is only "Low" flags, then is safe

[GoatonicReal]

ahhh oki i getcha, thank you for the updated version ^^
was wondering why it was showing "0.4"

[GoatonicReal]

also for that file, should i just stay clear of it? or (just a lil dumb)

[PanConChancho]

@GoatonicReal That unitypackage you have it should be safe to use

[ManMachine]

the latest poiyomi pro I got showed high risk, I don't know if I can use it:

======================================================================
vrcstorage-scanner — Batch Scan Report
Generated: Sat, 2 May 2026 16:23:51 +0000
Files scanned: 1

SUMMARY

Score Risk Level Sanitize File

---

167 CRITICAL no Poi.Pro.10.0.9.unitypackage

======================================================================
FILE 1/1: D:\VR\Poi.Pro.10.0.9.unitypackage

SHA-256 : 3e8b7520ae56fe3bff59ba165ac916809641cec49a9db1086777c4f44fc37678
Size : 100.9 MB
Score : 167 | Risk: CRITICAL | Duration: 1.11s | Action: AutoReject
Assets : total=1519 scripts=227 dlls=0 textures=284 audio=0 prefabs=9

FINDINGS (15):

[HIGH + 40pt] File write/delete operations detected in C# script (CS_FILE_WRITE)
File: Assets/_PoiyomiShaders/Scripts/poi-tools/Editor/PoiTexturePacker/PoiTexturePacker.cs
Lines: 436, 457, 465

[HIGH + 40pt] File write/delete operations detected in C# script (CS_FILE_WRITE)
File: Assets/_PoiyomiShaders/Scripts/Editor/ModularShaderSystem/LocalPreferences/ModuleTogglePreferences.cs
Lines: 233

[HIGH + 40pt] File write/delete operations detected in C# script (CS_FILE_WRITE)
File: Assets/_PoiyomiShaders/Scripts/poi-tools/Editor/ModularShaderStuff/ModularShadersGeneratorWindow.cs
Lines: 489, 529

[MEDIUM + 8pt] Texture file has high entropy 7.58 (possible embedded payload) (TEXTURE_HIGH_ENTROPY)
File: Assets/_PoiyomiShaders/Textures/Noise/T_Noise_No (9).TGA
Context: entropy=7.5828

[MEDIUM + 8pt] Texture file has high entropy 7.96 (possible embedded payload) (TEXTURE_HIGH_ENTROPY)
File: Assets/_PoiyomiShaders/Prefabs/Glass.png
Context: entropy=7.9608

[MEDIUM + 8pt] Texture file has high entropy 7.93 (possible embedded payload) (TEXTURE_HIGH_ENTROPY)
File: Assets/_PoiyomiShaders/Textures/Pixels/T_Pixel_IPS.png
Context: entropy=7.9337

[MEDIUM + 4pt] Meta file contains external object references (assets not included in package) (META_EXTERNAL_REF)
File: Assets/_PoiyomiShaders/TPS/Assets/Carrot/carrot.fbx

[MEDIUM + 4pt] Meta file contains external object references (assets not included in package) (META_EXTERNAL_REF)
File: Assets/_PoiyomiShaders/TPS/Assets/orifice.fbx

[MEDIUM + 4pt] Meta file contains external object references (assets not included in package) (META_EXTERNAL_REF)
File: Assets/_PoiyomiShaders/TPS/Assets/Jar/Jar.fbx

[MEDIUM + 4pt] Meta file contains external object references (assets not included in package) (META_EXTERNAL_REF)
File: Assets/_PoiyomiShaders/TPS/Assets/PenFBX.fbx

[LOW + 2pt] File is a valid image but in a different format than its extension suggests (MAGIC_MISMATCH_IMAGE)
File: Assets/_PoiyomiShaders/Prefabs/Glass.png
Context: declared_ext=png

[LOW + 2pt] File is a valid image but in a different format than its extension suggests (MAGIC_MISMATCH_IMAGE)
File: Assets/_PoiyomiShaders/Textures/Pixels/T_Pixel_IPS.png
Context: declared_ext=png

[LOW + 1pt] Long Base64-encoded field in YAML prefab/asset (may be inline texture or payload) (PREFAB_INLINE_B64)
File: Assets/_PoiyomiShaders/Textures/Gifs/T_FireWorks_GIF.asset
Context: length=678032

[LOW + 1pt] Long Base64-encoded field in YAML prefab/asset (may be inline texture or payload) (PREFAB_INLINE_B64)
File: Assets/_PoiyomiShaders/Textures/Gifs/T_Matrix_GIF.asset
Context: length=678032

[LOW + 1pt] Long Base64-encoded field in YAML prefab/asset (may be inline texture or payload) (PREFAB_INLINE_B64)
File: Assets/_PoiyomiShaders/Textures/Gifs/T_2ColorLines_GIF.asset
Context: length=87808

VERDICT: DO NOT INSTALL — potentially malicious, may compromise your system.

======================================================================
OVERALL RESULTS

Clean : 0
Low : 0
Medium : 0
High : 0
Critical : 1
Sanitized: 0

vrcstorage-scanner by SummerTYT

[anonberry]

@ManMachine Poiyomi models are known for having a high number of scripts, it's more likely to be a false positive than being malware. The scanner should be updated in a near future to improve detection in poiyomi models.

[PanConChancho]

@ManMachine As @anonberry said, it's more likely to be a false positive, in the latest poiyomi version (v10) they implement more stuff that isn't the version 9 so I have to update

[ManMachine]

perfect, ty. I can use them without worry, then

[NewbKid]

This is very interesting, tried it on a few things myself, there were a couple that flagged, one being "high" the other being critical. How can you tell between a false positive and a real critical? And say there was something that flagged a false positive and you went ahead and cleaned it anyways, would that remove any vital things from the package and possibly break it? Just curious.