Repository navigation
binary detected by defender #156
Description
node:fs:574
return binding.open(
^
Error: UNKNOWN: unknown error, open 'C:\Users\abcd\AppData\Local\Temp\pkg-mctuhd\992be7ea09d3e4281dfd435cf900b1fe1585aef73242dcf8e976ee8bdfca1665'
at Object.openSync (node:fs:574:18)
at Object.openSync (pkg/prelude/bootstrap.js:793:32)
at uncompressExternallyAndOpen (pkg/prelude/bootstrap.js:748:19)
at openFromSnapshot (pkg/prelude/bootstrap.js:771:30)
at Object.openSync (pkg/prelude/bootstrap.js:798:12)
at copyInChunks (pkg/prelude/bootstrap.js:169:26)
at Object.copyFileSync (pkg/prelude/bootstrap.js:1182:5)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:247:12)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:203:9)
at copyFolderRecursiveSync (pkg/prelude/bootstrap.js:203:9) {
errno: -4094,
code: 'UNKNOWN',
syscall: 'open',
path: 'C:\Users\abcd\AppData\Local\Temp\pkg-mctuhd\992be7ea09d3e4281dfd435cf900b1fe1585aef73242dcf8e976ee8bdfca1665'
}
Node.js v20.19.1
Activity
emdaivaanhdai commentedon May 30, 2025
robertsLando commentedon Jun 3, 2025
This is a known "issue", you should just ignore this.
risharde commentedon Jun 10, 2025
@robertsLando Do you know what code would be causing this? I mean this is a deal breaker for anyone trying to use this commercially. I came across another repo related to Android in which non of the developers were interested in knowing why anti-virus was flagging a very well known socket.io implementation. I literally had to find an alternative and I am hoping this repo will not go in the same direction because the potential to have a self executable is a wonderful feature.
So if there's a way to determine what code might be 'dangerous' I can try to help out.
robertsLando commentedon Jun 10, 2025
IMO the problem is that we are patching nodejs binaries, so our binary is different from the official one and the antivirus may notice this, unfortunately we have no other choice here, I could tell you to try with
--seaflag but it's super limited compared to normal package and I'm still not 100% sure the antivirus doesn't complain about that as well as anyway the resulted binary will be a nodejs binary with your code bundled into it so still different from the official nodejs buildrisharde commentedon Jun 10, 2025
@robertsLando oh interesting! Thank you for taking the time to explain the inner workings of pkg. I'm shooting in the dark a little but could this be related to perhaps signing after modifying node? I've seen situations where unsigned apps trigger AV so just wondering.
faulpeltz commentedon Jun 10, 2025
Isn't the offending file in this case a native node module uncompressed for loading?
You can also submit binaries and flag them as "incorrectly classified as malware":
https://www.microsoft.com/en-us/wdsi/filesubmission
You can also try to submit the binary to virustotal to check engine detections/sandbox analysis
robertsLando commentedon Jun 10, 2025
@faulpeltz Yeah in the specific case of this issue the problem seems to be a file we load to a local folder but it's something that comes from the user not pkg but I also saw some cases where the antivirus detects the pkg binary as malicious