Does the executable file contain a virus? #214

Closed
opened 2026-02-16 00:20:31 -05:00 by yindo · 5 comments
Owner

Originally created by @lemonit-eric-mao on GitHub (Dec 7, 2025).

Does the executable file contain a virus?

Versions

  1. dify-plugin-daemon 0.4.1
Originally created by @lemonit-eric-mao on GitHub (Dec 7, 2025). ## Does the executable file contain a virus? **Versions** 1. dify-plugin-daemon 0.4.1
yindo closed this issue 2026-02-16 00:20:31 -05:00
Author
Owner

@lemonit-eric-mao commented on GitHub (Dec 7, 2025):

image

https://github.com/langgenius/dify-plugin-daemon/releases/download/0.4.1/dify-plugin-windows-amd64.exe

Microsoft has flagged this version as containing a virus. Could you please fix it?

Image

My terminal tool has also been affected.


I downgraded to version 0.4.0, which works, and have repackaged and resubmitted it.

@lemonit-eric-mao commented on GitHub (Dec 7, 2025): <img width="3195" height="900" alt="image" src="https://github.com/user-attachments/assets/7ce25282-a90f-4cc5-8176-2daffefd9371" /> https://github.com/langgenius/dify-plugin-daemon/releases/download/0.4.1/dify-plugin-windows-amd64.exe Microsoft has flagged this version as containing a virus. Could you please fix it? <img width="809" height="559" alt="Image" src="https://github.com/user-attachments/assets/590cd3ac-456e-4cbd-8775-fa8d3d615ac5" /> My terminal tool has also been affected. --- I downgraded to version 0.4.0, which works, and have repackaged and resubmitted it.
Author
Owner

@lemonit-eric-mao commented on GitHub (Dec 7, 2025):

Image

@lemonit-eric-mao commented on GitHub (Dec 7, 2025): ![Image](https://github.com/user-attachments/assets/69e90472-d8c3-40df-904e-b137167e93b3)
Author
Owner

@lemonit-eric-mao commented on GitHub (Dec 7, 2025):

https://www.virustotal.com/gui/home/upload

@lemonit-eric-mao commented on GitHub (Dec 7, 2025): https://www.virustotal.com/gui/home/upload
Author
Owner

@Mairuis commented on GitHub (Dec 9, 2025):

Hi @lemonit-eric-mao,

Thank you for reporting this issue.

This is a false positive from Microsoft Defender. Go-compiled executables are sometimes flagged by antivirus software due to the way Go binaries are structured (they include the Go runtime and can appear similar to packed/obfuscated malware).

This is a known issue in the Go community and happens frequently with legitimate Go applications. You can verify the safety of our releases by:

  1. Building from source - Clone the repository and build it yourself using go build
  2. Checking VirusTotal - Most reputable antivirus engines should not flag it
  3. Comparing checksums - Verify the downloaded file matches our release checksums

We recommend adding an exception in Windows Defender for the executable if you trust the source.

If you continue to have concerns, feel free to build the CLI tool directly from our source code.

Thank you for your understanding!

@Mairuis commented on GitHub (Dec 9, 2025): Hi @lemonit-eric-mao, Thank you for reporting this issue. This is a **false positive** from Microsoft Defender. Go-compiled executables are sometimes flagged by antivirus software due to the way Go binaries are structured (they include the Go runtime and can appear similar to packed/obfuscated malware). This is a known issue in the Go community and happens frequently with legitimate Go applications. You can verify the safety of our releases by: 1. **Building from source** - Clone the repository and build it yourself using `go build` 2. **Checking VirusTotal** - Most reputable antivirus engines should not flag it 3. **Comparing checksums** - Verify the downloaded file matches our release checksums We recommend adding an exception in Windows Defender for the executable if you trust the source. If you continue to have concerns, feel free to build the CLI tool directly from our source code. Thank you for your understanding!
Author
Owner

@Mairuis commented on GitHub (Dec 9, 2025):

Closing this issue as it appears to be a false positive from antivirus software. If you have any further questions or encounter other issues, please feel free to reopen or create a new issue. Thanks!

@Mairuis commented on GitHub (Dec 9, 2025): Closing this issue as it appears to be a false positive from antivirus software. If you have any further questions or encounter other issues, please feel free to reopen or create a new issue. Thanks!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-plugin-daemon#214