chai2010 / chai2010/webp

Windows Defender warnings for containing Trojan:Win32/Wacatac.B!ml

Open
#80 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
723
Forks
113
PR merge metrics
No merged PRs in 30d

Description

I added this package (`github.com/chai2010/webp v1.4.0`) to a Wails project, and now every time I run the development environment with `wails dev`, Windows Defender shows me a couple of warnings about malicious threads that disappear shortly after. I checked directly in the Windows Defender window, and for a moment it shows warnings about the `Win32/Wacatac.B!ml `trojan. I reviewed the details, and it shows that the file `C:\Users\MyUser\AppData\Local\Temp\go-link-numericcode\a.out` is infected.

Image

Image

Image

Image

I am using the package to encode WebP images in a function that runs concurrently. Although in another project using only Go and an earlier version of this package without concurrency, I recall that Google Drive would occasionally flag the built executable as malicious.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the report with github.com/chai2010/webp v1.4.0 in a Wails project using wails dev, including the concurrent WebP encoding path. Check the Windows Defender warning for the temporary go-link-numericcode/a.out file and compare it with the earlier non-concurrent Go project. Done means establishing whether the package reliably triggers the warning and documenting a confirmed, actionable cause or reproduction.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.