search

kardolus / chatgpt-cli

ChatGPT CLI is a versatile tool for interacting with ChatGPT models via OpenAI and Azure, as well as with models from Perplexity AI. It offers streaming, query mode, and history tracking for seamless, context-aware interactions. With extensive configuration options, it’s designed for both users and developers to create a tailored GPT experience.
MIT License
501 stars 34 forks source link

Trojan? #52

Closed Nehc closed 2 months ago

Nehc commented 3 months ago

Windows won't let me download chatgpt-windows-amd64.exe- it says:Trojan:Win32/Sabsik.FL.A!ml - it scares. (

kardolus commented 3 months ago

@Nehc that's wild. I use this script to generate the binaries: https://github.com/kardolus/chatgpt-cli/blob/main/scripts/binaries.sh

Can you help me test this? Run the script on a linux or mac box and try running the binary on your windows box. Alternatively I can try and run windows on a virtual box. Can you provide some details on how to reproduce the error in case I spin up a windows box?

kardolus commented 3 months ago

PS thanks for reporting this. I really appreciate it.

Nehc commented 3 months ago

image I don't currently have an English operating system, but here is a translated screenshot from Windows Defender - maybe there is information there that will help.

I'm not saying that there's a virus there - it's quite possible that these are some errors in the Defender's heuristic algorithms. Now it seems that he allows you to download the file - he doesn’t swear right away. I can’t help with dosbox right now.

webfile: D:\Wald\Downloads\chatgpt-windows-amd64 (1).exe|https://objects.githubusercontent.com/github-production-release-asset-2e65be/634938527/d114be68-7fd6-4a0b-82ab-ad563328696a?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240607%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240607T123747Z&X-Amz-Expires=300&X-Amz-Signature=a117188e6610c47ae8550ded0add7f866cb1274febb97879e839b65aa30da34e&X-Amz-SignedHeaders=host&actor_id=8426195&key_id=0&repo_id=634938527&response-content-disposition=attachment%3B%20filename%3Dchatgpt-windows-amd64.exe&response-content-type=application%2Foctet-stream|pid:22488,ProcessStart:133622374882305466

kardolus commented 3 months ago

Thanks @Nehc, this may take me a minute to reproduce (I need some help from someone who has both a mac/linux box and a windows box).

kardolus commented 3 months ago

@Nehc do you happen to have an update on this? Do you have access to a linux to box to create the binary on your side? Alternatively I could create you one from a different box to see if that helps.

kardolus commented 3 months ago

@Nehc I was thinking, I can create you a binary on an EC2 box. If it gives you the same warning as the binary from my Mac, then it is very likely it is a false alarm. Would that work for you? I don't know many folks with a Windows box :)

fmeyer commented 2 months ago

Hi, not affected but just helping out having a similar situation;

Both your GH download URL

https://www.virustotal.com/gui/url/4338f73a5040435b547a332a7bbc27fee0b0ce77f46132905162779400deea01/detection

and binary are flagged

https://www.virustotal.com/gui/file/71c094dd6990bfcaf935f57285432175ee33b9590c6d4502d8cced8b745d054d/behavior

Cleaning those are pretty hard, I suggest you releasing a new binary and ship it in a zip file.

Since these databases are built by vendors on behalf of their customers it might be hard to clean your previous hash.

If you notice the pattern continues to happen you need to probably trim down some indirect dependencies that might be sloppy on windows.

Best,

kardolus commented 2 months ago

@fmeyer thank you so much! I just released a new binary: https://github.com/kardolus/chatgpt-cli/releases/download/v1.6.1/chatgpt-windows-amd64.exe

I bumped the dependencies first. Hope that this resolves the issue. Fingers crossed!

kardolus commented 2 months ago

Closing this for now, but feel free to re-open if the updated binary does not resolve the issue. Thanks y'all!