[BUG][code-analyzer] `sf code-analyzer run ...` causes Windows Defender to spike the CPU

Have you tried to resolve this issue yourself first?

Yes

Bug Description

Any time that I run sf code-analyzer run ..., I almost immediately see a CPU spike, and MsMpEng is right alongside the host node process in CPU consumption:

The directory containing Salesforce projects is already in the exclusion list, and I don't see any issues running other sf commands from these projects. I'm guessing that something else being executed by Code Analyzer needs to be excluded, no? Any idea what that would be? I'm not comfortable excluding node altogether for what I hope are obvious reasons.

Output / Logs

I also timed command execution with and without Defender active, and the impact is pretty significant:

Defender enabled: 2m6.395s
Defender disabled: 0m49.501s

Steps To Reproduce

Run Code Analyzer on Windows with Defender enabled.

Expected Behavior

There's some safe way to configure Windows Defender exclusions so that Code Analyzer can run without spiking the CPU.

Operating System

Windows 11

Salesforce CLI Version

@salesforce/cli/2.87.7 win32-arm64 node-v22.13.0

Code Analyzer Plugin (@salesforce/sfdx-scanner) Version

code-analyzer 5.0.0 (5.0.0)

Additional Context (Screenshots, Files, etc)

No response

Workaround

No response

Urgency

Low

まず、Defender を有効にした Windows 11 で、code-analyzer 5.0.0 と報告されている CLI バージョンを使用して sf code-analyzer run ... を再現し、その後、Defender を無効にした場合と CPU 使用率および実行時間を比較します。どの Code Analyzer のプロセスまたはディレクトリが Defender のスキャンをトリガーするのかを調査します。Node をグローバルに除外せずにスパイクを回避する安全な除外設定が文書化または実装されれば完了です。