wgpu-native EXE diagnosed as Trojan:Win32/Sabsik.FL.A!ml or Trojan:Win32/Wacatac.B!ml

[garettbass]

I started getting this diagnostic today. My simple program linking with wgpu-native (and no other non-system libs) is quarantined by Windows Security for matching one of the following trojan profiles:

• Trojan:Win32/Sabsik.FL.A!ml (compiled today)
• Trojan:Win32/Wacatac.B!ml (compiled yesterday)

I have experienced this issue when linking with either of these releases of wgpu-native:

• commit-sha v0.18.1.4 (these files have version numbers lately instead of SHAs)
  • this is a version that requires linking with ws2_32 (WinSock 2.0) among others, so it seems more obvios as a potential threat vector
• commit-sha 22eaa9caeb4e856cb926ca54eefa9f783fc4c524
  • this older version does not require linking with ws2_32, though it could dynamically load WinSock APIs

The only other FOSS software in my toolchain for this little hobby project is clang v 15.0.6 from the official LLVM distribution. When I use the same clang to build a simple hello world EXE that does not link with wgpu-native, it is not diagnosed as a trojan by Windows Security.

Anyone else encountering this? Thanks in advance for any context.

[garettbass]

Curiously, the same compilation is no longer being flagged as a trojan. Maybe something strange going on with Windows Defender?

[garettbass]

I recommend closing unless other start seeing this more often. Thanks!

[almarklein]

Thanks for the report! Glad that it seems to be a Defender glitch. If anyone else encounters this, please comment below, and we can re-open.