starred/act

Fork 0

mirror of https://github.com/nektos/act.git synced 2026-04-26 09:25:54 +03:00

[GH-ISSUE #2577] Windows Defender false alert on v0.2.70 #1171

New issue

Closed

opened 2026-03-01 21:49:27 +03:00 by kerem · 2 comments

kerem commented

2026-03-01 21:49:27 +03:00

Owner

Originally created by @ghost on GitHub (Dec 17, 2024).
Original GitHub issue: https://github.com/nektos/act/issues/2577

Bug report info

-- coudn't execute it --

Command used with act

-- coudn't execute it --

Describe issue

Hello,

on my machine occured following problem: On the latest release ( v0.2.70 ) the windows defender automatically deletes the act.exe based on a recognized trojan ( Win32/Bearfoos.A!ml ).
It seems to be related on the latest changes updated dependencies because when using the v0.2.69 everything works as expected and fine.
Also based on the result of virus total it seems to be a false/positive warning ( see: https://www.virustotal.com/gui/file/f58096e5202c879023f844b68f483b3331a61859e86bdef11c074a84990f900b )

Link to GitHub repository

No response

Workflow content

-- coudn't execute it --

Relevant log output

-- coudn't execute it --

Additional information

No response

Originally created by @ghost on GitHub (Dec 17, 2024). Original GitHub issue: https://github.com/nektos/act/issues/2577 ### Bug report info ```plain text -- coudn't execute it -- ``` ### Command used with act ```sh -- coudn't execute it -- ``` ### Describe issue Hello, on my machine occured following problem: On the latest release ( v0.2.70 ) the windows defender automatically deletes the act.exe based on a recognized trojan ( Win32/Bearfoos.A!ml ). It seems to be related on the latest changes updated dependencies because when using the v0.2.69 everything works as expected and fine. Also based on the result of virus total it seems to be a false/positive warning ( see: https://www.virustotal.com/gui/file/f58096e5202c879023f844b68f483b3331a61859e86bdef11c074a84990f900b ) ![2024_12_17_10_56_39_Ausschneiden_und_skizzieren](https://github.com/user-attachments/assets/a3ab2ea7-db1c-4fe0-85c3-71c33c5b846c) ### Link to GitHub repository _No response_ ### Workflow content ```yml -- coudn't execute it -- ``` ### Relevant log output ```sh -- coudn't execute it -- ``` ### Additional information _No response_

kerem

2026-03-01 21:49:27 +03:00

closed this issue
added the
kind/bug
label

kerem commented

2026-03-01 21:49:28 +03:00

Author

Owner

@ChristopherHX commented on GitHub (Dec 17, 2024):

I could guess two things act does might cause the detection. However except the automated dependency updates nothing changed as you said.

Interesting this comes up 16-17 days after the binary has been published via automation.

The xdg dependency (which has been bumped in 0.2.70), this is used to create a folder before asking the first time survay (the first virus scanner alert coming from winget shortly after a xdg folder has been created without user prompt in an act release)
the call to home version check of cplee

I'm not using windows right now and my regular merges to master are blocked due to lack of reviewer. Blind trust in dependablebot PR's.

winget has at the time of writing not even 0.2.70 and they might should avoid to merge the update if defender really detects something for whatever reason and nothing meaningful has been changed.

@ChristopherHX commented on GitHub (Dec 17, 2024): I could guess two things act does might cause the detection. However except the automated dependency updates nothing changed as you said. Interesting this comes up 16-17 days after the binary has been published via automation. - The xdg dependency (which has been bumped in 0.2.70), this is used to create a folder before asking the first time survay (the first virus scanner alert coming from winget shortly after a xdg folder has been created without user prompt in an act release) - the call to home version check of cplee I'm not using windows right now and my regular merges to master are blocked due to lack of reviewer. Blind trust in dependablebot PR's. winget has at the time of writing not even 0.2.70 and they might should avoid to merge the update if defender really detects something for whatever reason and nothing meaningful has been changed.

kerem commented

2026-03-01 21:49:28 +03:00

Author

Owner

@ghost commented on GitHub (Dec 18, 2024):

Thanks for the quick response!
Due the fact that winget merged your PR already and all the other scans were negative I think we can say for sure its fine and I'll close this bug.

@ghost commented on GitHub (Dec 18, 2024): Thanks for the quick response! Due the fact that winget merged your PR already and all the other scans were negative I think we can say for sure its fine and I'll close this bug.

kerem referenced this issue

2026-03-01 21:52:49 +03:00

[PR #1171] [MERGED] Improve logging #1820

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/act#1171

No description provided.

Rows
Columns