Possible false positive in VirusTotal scan

[Mazer-R]

Hi,

I downloaded the latest version of this project (.exe file) and scanned it using VirusTotal.

The scan reports 4 detections from the following vendors:

Bkav Pro → W64.AIDetectMalware
SecureAge → Malicious
Trapmine → Malicious.moderate.ml.score
Zillya → Trojan.GenKryptik.Win64.67176

VirusTotal report: [https://www.virustotal.com/gui/file/cdc7f6646a5c12dec49dfd00a32b51c119217bfeb06532150ee02f9557eeb991/detection]

These detections appear to be heuristic / ML-based rather than signature-based, so this might be a false positive.

Could you please confirm whether this is expected or if it should be investigated further?

Thanks!

[ThisIs-Developer]

Oh my gosh, thanks for reporting this @Mazer-R .

I haven’t fully implemented this desktop functionality myself, so I’ll coordinate with @ramezio on the GitHub issue below, since they contributed to this feature:

#23

We’ll investigate whether this is a false positive and work on resolving it as soon as possible.

[ThisIs-Developer]

Hey @ramezio ,

Could you please take a look at this issue and share your findings on what might be causing it? Since many users rely on your desktop feature in the Markdown app, these warnings are understandably concerning and may affect user trust.

As this appears related to the desktop functionality you contributed, your input would be especially valuable in determining whether this is a false positive caused by packaging/build artifacts or something that needs deeper investigation.

Would appreciate your response as soon as possible so we can address this promptly and keep users informed.

Thanks.

[ramezio]

Hi @ThisIs-Developer,

Thank you @Mazer-R for bringing this to our attention. I will be looking into this now.

EDIT: This does not seem to match up with the mentioned dates for the neutralinojs supply-chain attack below. Additionally, some of the flags and associated vendors seem frequently responsible for generating false positives. Highly likely to be a false alarm, but still reviewing it.

My spontaneous thought goes to the neutralinojs March 2 supply-chain attack, described here. However, it requires further investigation to confirm.

@ThisIs-Developer It might be wise to temporarily remove the release in question until this is concluded, to err on the side of caution.

[ThisIs-Developer]

@ramezio Thanks for confirming that the warning is not due to the supply-chain attack. I understand it’s a false alarm. Please take your time to find a solution to resolve this, as I really value the desktop app features. Thank you, I appreciate it.

[ThisIs-Developer]

@Mazer-R Thank you for bringing this to our attention. @ramezio and I will work on resolving this as soon as possible. In the meantime, we will continue with this version and will not remove it, as this currently appears to be a false alarm.

[Mazer-R]

Thank you very much @ThisIs-Developer @ramezio for your quick responses and addressing the issue. I really value your tool, and the desktop app features.