Suspicious "Twitterr" snap requires attention (was: Are there risks associated with installing random snaps?)

If it was malicious wouldn’t they have wanted me to launch it? strange they didn’t provide any entrypoints to launch.

and can I assume the ability to remove the app, which I apparently had through software centre interface, was legit?

As far as I can tell the recipe looks like its copied from a tutorial, maybe it’s just a novice packager testing out an empty snap and published it with suspicious metadata.

Not sure though, we should wait for the store staffs to verify all the snap revisions the publisher published before jumping to conclusions.

It is legit as it communicates to the same snapd daemon via its backend. You may also remove the snap by running the snap remove _snap_id_ command in a terminal.

so in this case I would run snap remove _snap_id_twitterr ? But I don’t see it listed amongst my snaps when i run snap list so i guess i’ve got rid of it. I just hope installing it didn’t compromise my documents that would really suck.

snap remove twitterr to be accurate :wink:


Some additional details according to the snap publisher’s info(may be fake):

According to the assuming project’s issue tracker, the publisher had attempted to publish the application via snaps but not succeeded: I can’t find and can’t run twitterr · Issue #1 · KorbsStudio/Twitterr

I’ve pinged the seemed-to-be publisher on Twitter to see whether they can do something about it.

thanks a lot for the time you’ve put towards helping out with this. It’ll be nice for the sake of all the users of snapstore to know what’s the deal with the app. You’ve been super helpful Lin-Buo-Ren!

The name is so similar and the profile photo lead me to not even look to the info or reviews I stupidly just hit install didn’t even realize the letters. Oh well. But it’ll be nice to know if any of us who have downloaded the app need be worried or not.

1 Like

I’m fairly certain that the Snap is not malicious, though I can’t verify 100% because I can’t check previous versions as @Lin-Buo-Ren mentioned. I think on balance that you’re most likely safe and have not had anything compromised.

3 Likes

I’ve downloaded every revision of the twitterr snap, and there’s nothing other than a snap.yaml, manifest.yaml and snapcraft.yaml in them. It’s inert, likely an unfinished project, with an incorrect or incomplete packaging configuration. Nothing to see here.

5 Likes

Thank you very much for looking at every revision! I really appreciate it! It’s nice to know there is nothing to worry about!

1 Like

Hi there, this is Korbs Studio.
I would like to confirm that Twitterr didn’t successfully make it into the Snap Store, as I wasn’t able to configure certain things.

Also this project it no longer active, as GitHub does say the project is archived.
Appears Twitterr might be on an old Snap account of mine, I’ll try to look into it and set to private or remove from the store entirely.

If you have anymore questions about my projects, I recommend DMing me on Twitter, as I am more active there or Discord (Korbs#0001).

6 Likes