search

mvdan / sh

A shell parser, formatter, and interpreter with bash support; includes shfmt
https://pkg.go.dev/mvdan.cc/sh/v3
BSD 3-Clause "New" or "Revised" License
6.99k stars 333 forks source link

Multiple VirusTotal detections for Windows binairies #945

Closed itsame-mcl closed 1 year ago

itsame-mcl commented 1 year ago

Hello, I tried to install shfmt through the scoop main bucket on my Windows 10 computer with Trellix anti-virus software, but as soon as I try to use it, this antivirus software flags the binary as malware and delete it.

This behavior seems to be shared by 5 vendors, based on VirusTotal : https://www.virustotal.com/gui/file/f759493bc55a4ea181442eb7d79b527ff6c15d62ec567b8b86a5df6a086c9c46/detection

It looks like an automatic detection rule of the Hive malware family is triggered, probably because of the Go compiler. I know I could rebuild this executable on my computer (I can't disable or change the AV vendor on this system), but I will lose the benefits of using scoop for updating my installed tools.

mvdan commented 1 year ago

See https://go.dev/doc/faq#virus. I can't really do anything about it because, well, shfmt is not malware.