Bug: fzf-lua detected as trojan (Trojan:Win32/ClickFix.ZZN!MTB)

[bigtanuki64]

RTFM Checklist

• I have searched exisiting issues / discussions
• I have read the Wiki including the Advanced section
• I have read man fzf / I am well versed in shell fzf

Operating system

Windows

Shell

pwsh

Neovim version (nvim --version)

NVIM v0.11.5; Build type: Release; LuaJIT 2.1.1741730670

Fzf version (fzf --version)

0.58.0 (65db735)

Output of :lua print(os.getenv('FZF_DEFAULT_OPTS'))

nil

Is the problem reproducible with mini.sh?

• My issue is reproducible with mini.sh
• My issue IS NOT reproducible with mini.sh
• I have not tested with mini.sh (not relevant, requires LSP, Windows, etc)

Fzf-lua configuration

-- this is really just my keymappings so i don't think it's relevant
  require('fzf-lua').setup {
    keymap = {
      fzf = map.fzf_lua_keymap
    }
  }
  map.fzf_lua()

-- lua/user/map.lua

function M.fzf_lua()
  local fzf_lua = require('fzf-lua')
  vim.keymap.set('n', '<C-p>',
    -- fzf_lua.files({ fd_opts =  [[--color=never --hidden --type file --type symlink --exclude .git]] }),
    fzf_lua.files,
    { desc = 'Fzf Files'}
  )
  vim.keymap.set('n', '<C-f>', fzf_lua.live_grep, { desc = 'Fzf Grep'})
end

M.fzf_lua_keymap = {
  ['ctrl-q'] = 'select-all+accept',
}

Describe the bug / steps to reproduce

I opened nvim in my ~ dir and tried searching for files using fzf-lua, then Windows Defender gave me the message that I was infected with a trojan:

Affected items:  
CmdLine: C:\Windows\System32\cmd.exe ^C:/Program^ Files/Neovim/bin/nvim.exe^ -u NONE -l ^C:/Users/foo/AppData/Local/nvim-data/site/pack/deps/opt/fzf-lua/lua/fzf-lua/rpc.lua^ 9 nil ^󰨊 dotfiles\src\Microsoft.PowerShell_profile.ps1^ ^microsoft.powe^ 178

[ibhagwan]

I don’t know the criteria for Microsoft defender to deem this a trojan.

Not sure what can be done about this, don’t take my word for it, read what the code does, it’s not a trojan :)

[phanen]

It's nvim detected as trojan? neovim/neovim#5433 (comment)

[bigtanuki64]

@ibhagwan I think it's almost certainly a false positive, I will report it as such to Microsoft. I thought it would still be useful to file this issue, to let others know that it's not dangerous. If you believe otherwise, feel free to remove it.

@phanen The Neovim binaries seem fine, Defender doesn't complain about them at least.

[ibhagwan]

Tysm @bigtanuki64, no need to close this, it’s good to let people know.

I’d also like to resolve this if possible, I’m just unsure how ATM.