False positive?

[Jasiek22]

So i downloaded the EssentialsXDiscord for my server and i've runned it (like i run every file downloaded) with virus total and got 2 positives, one from google that shows detected, and one from ikarus that shows Trojan.Java.GenericGB. I've scanned it though my Norton too and it didn't show a thing. I've downloaded it from https://essentialsx.net/ Is this a false positive or i should be worried?

[Chew]

Probably related to #4833, likely something buried in JDA. Not much we can do.

[BlockyTheDev]

Yes it is related to my issue #4833 like mentioned. After the issue got closed I reported it to Bitdefender, Google and an other one (I think it was ikarus, but I am not sure), but the only answer I got was from Bitdefender, which isn't flagging it since there.

[mdcfe]

This is a false positive and has happened before (as seen in the other answer). We've checked and it appears that certain classes from dependencies get flagged up, but different AVs flag up different classes and none of those have any malicious code within them.

Certain compiled Java classes include $ in their file names. It seems that the virus scanners in question flag up these $ characters as a possible attempt at injecting code/extracting variables from a terminal or shell script. Of course this isn't actually the case, as the names of these files would never actually get inserted into a terminal prompt or read by a shell script, but the AV detections don't seem to account for this.

If the jar was actually malicious, it would likely have been flagged up by several more scanners with a more specific detection, not a generic "trojan" detection. There's not much we can do besides reporting these jars as false positives and hoping those companies update their detection to account for inner classes.