binary detected by defender

[Hoangdepzaivcl]

node:fs:574
return binding.open(
^

Error: UNKNOWN: unknown error, open 'C:\Users\abcd\AppData\Local\Temp\pkg-mctuhd\992be7ea09d3e4281dfd435cf900b1fe1585aef73242dcf8e976ee8bdfca1665'
at Object.openSync (node:fs:574:18)
at Object.openSync (pkg/prelude/bootstrap.js:793:32)
at uncompressExternallyAndOpen (pkg/prelude/bootstrap.js:748:19)
at openFromSnapshot (pkg/prelude/bootstrap.js:771:30)
at Object.openSync (pkg/prelude/bootstrap.js:798:12)
at copyInChunks (pkg/prelude/bootstrap.js:169:26)
at Object.copyFileSync (pkg/prelude/bootstrap.js:1182:5)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:247:12)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:203:9)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:203:9) {
errno: -4094,
code: 'UNKNOWN',
syscall: 'open',
path: 'C:\Users\abcd\AppData\Local\Temp\pkg-mctuhd\992be7ea09d3e4281dfd435cf900b1fe1585aef73242dcf8e976ee8bdfca1665'
}

Node.js v20.19.1

[Hoangdepzaivcl]

[robertsLando]

This is a known "issue", you should just ignore this.

[risharde]

@robertsLando Do you know what code would be causing this? I mean this is a deal breaker for anyone trying to use this commercially. I came across another repo related to Android in which non of the developers were interested in knowing why anti-virus was flagging a very well known socket.io implementation. I literally had to find an alternative and I am hoping this repo will not go in the same direction because the potential to have a self executable is a wonderful feature.

So if there's a way to determine what code might be 'dangerous' I can try to help out.

[robertsLando]

IMO the problem is that we are patching nodejs binaries, so our binary is different from the official one and the antivirus may notice this, unfortunately we have no other choice here, I could tell you to try with --sea flag but it's super limited compared to normal package and I'm still not 100% sure the antivirus doesn't complain about that as well as anyway the resulted binary will be a nodejs binary with your code bundled into it so still different from the official nodejs build

[risharde]

@robertsLando oh interesting! Thank you for taking the time to explain the inner workings of pkg. I'm shooting in the dark a little but could this be related to perhaps signing after modifying node? I've seen situations where unsigned apps trigger AV so just wondering.

[faulpeltz]

Isn't the offending file in this case a native node module uncompressed for loading?

You can also submit binaries and flag them as "incorrectly classified as malware":
https://www.microsoft.com/en-us/wdsi/filesubmission

You can also try to submit the binary to virustotal to check engine detections/sandbox analysis

[robertsLando]

@faulpeltz Yeah in the specific case of this issue the problem seems to be a file we load to a local folder but it's something that comes from the user not pkg but I also saw some cases where the antivirus detects the pkg binary as malicious