Reported as Suspicious:W32/Malware!DeepGuard.hg by F-Secure

Schniz / fnm

🚀 Fast and simple Node.js version manager, built in Rust

https://fnm.vercel.app

GNU General Public License v3.0

18.38k stars 470 forks source link

Reported as Suspicious:W32/Malware!DeepGuard.hg by F-Secure #1325

Open brainz80 opened 1 week ago

brainz80 commented 1 week ago

Latest version reported as Suspicious:W32/Malware!DeepGuard.hg by F-Secure Total Antivirus.

Schniz commented 1 week ago

Can you explain more? Which artifact are we talking about?

brainz80 commented 1 week ago

After updating to latest version available on Winget fnm.exe wouldn't run anymore and F-Secure reported it as Suspicious:W32/Malware!DeepGuard.hg.

I can't say anything more specific. This might be a false-positive reported by F-Secures heuristic scan or something nasty might have gotten itself into the file somehow. Thought I'd report it here.

I did report this to F-Secure for analysis as well.

brainz80 commented 1 week ago

I don't know what's wrong with the latest version downloaded from WinGet. But I just built fnm from source and no F-Secure doesn't report anything for this.

I noticed also a discrepancy between the file sizes:

built from v1.38.0 (target: x86_64-pc-windows-gnu): 19185105 bytes, 92D9EA6D1218D1A30D84E50D72F79258CE3F7207AAC4F22B17532888DA6DB7EF (SHA256)
Schniz.fnm from WinGet (version 1.38.0): 7755776 bytes, BC7388EF6899627700E12987D4E79F7B7549580FE1F447E44DA71369E634C4F8 (SHA256)