Closed mgpcoe closed 1 year ago
Thank you for reporting.
To install "blessed" dependencies, you need to pass --locked
to cargo install
. This is by some (me included) considered a bad default behaviour in cargo
. This is tracked in https://github.com/rust-lang/cargo/issues/7169
The installation instructions in our README is using --locked
in the instructions to install from source.
Regarding the malware, do you know if this has been reported to homebrew?
Does your anti-virus software also detect malware if you install with cargo install --locked bat
?
Would be great if you could try other installations methods.
If we can isolate this to only affect homebrew, that would be very good to know.
@mgpcoe I can't reproduce this with virustotal.com and Linux. Neither with nor without --locked
. Does virustotal.com complain about the binary you have?
Here are the results of both builds:
--locked
: https://www.virustotal.com/gui/file/461de503a9e4001d342e30f2a01aaa11391496f9d8ec766d1f0b21403039fcc5--locked
: https://www.virustotal.com/gui/file/8e9c6fde8c45810f242866b3eb91790a83eb60e701076bd1907f70c108d77dbdHere are my commands
Edit: I can't reproduce with cargo install bat
on Mac either: https://www.virustotal.com/gui/file/be9fae824f2295fc8c6a3fc5001f0c1115c0325e52b6d798aa3bd851defb577e
I don't see a reason to keep this issue open any longer. Closing.
What steps will reproduce the bug?
latest
What happens?
Up-to-date malware scanners detect and isolate
monero.rb
.What did you expect to happen instead?
Not to have such a useful tool act as a Trojan horse for a crypto miner.
How did you install
bat
?homebrew
Cause seems pretty obvious -- there doesn't appear to be any dependency version pinning on 0.22.1, so any of
bat
's dependencies, or their unpinned dependencies, could easily introduce this problem. Please be sure to always pin your dependency versions.