anti virus triggering.

[SamHoque]

Describe the bug

When running the build command, I am getting an anti virus alert on the manifest.json file.

Reproduction

run build

Steps to reproduce

No response

System Info

System:
    OS: Windows 11 10.0.22631
    CPU: (24) x64 12th Gen Intel(R) Core(TM) i9-12900K
    Memory: 10.93 GB / 31.79 GB
  Binaries:
    Node: 18.20.2 - C:\Program Files\nodejs\node.EXE
    npm: 10.5.0 - C:\Program Files\nodejs\npm.CMD
    pnpm: 9.12.2 - C:\Program Files\nodejs\pnpm.CMD
    bun: 1.1.42 - ~\.bun\bin\bun.EXE
  Browsers:
    Edge: Chromium (124.0.2478.80)
    Internet Explorer: 11.0.22621.3527
  npmPackages:
    wxt: ^0.19.19 => 0.19.19

Used Package Manager

bun

Validations

• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[aklinker1]

Link for reference: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:JS/FakeBardExt.B

Woah, thanks for reporting, that's not good... Unfamiliar with these window defender alerts, and the Microsoft doc sucks, doesn't tell us anything.

I don't have Windows, so could you do some testing for me?

• Does it only happen for v0.19.19 of WXT? What about the latest version, v0.19.22? What about an older version, like v0.17.12?
• What about a different package manager, does it happen with NPM?
• Does this happen during the build, or afterwards at some point, like when trying to load the file into a browser?
• Can you share the file's contents?

[SamHoque]

1. Same issue with Wxt v.0.19.22
2. I don't think its an npm package manager issue, since I am using the template https://github.com/mefengl/wxt-starter, and that doesn't seem to trigger anti virus
   , something to do with my changes from the config, I'll further investigate this.
3. Only happens during build, dev runs fine. (happens right after build is finished)
4. manifest.json

[SamHoque]

additional note. I am trying to migrate my extension from plasmo to wxt, and I didn't have any anti virus issues with plasmo.

edit:

same virus issue with pnpm and npm

[SamHoque]

I was able to replicate the virus on a new repo, I have published it under. https://github.com/SamHoque/wxt-virus-demo

[SamHoque]

1. Same issue with Wxt v.0.19.22
2. I don't think its an npm package manager issue, since I am using the template https://github.com/mefengl/wxt-starter, and that doesn't seem to trigger anti virus
   , something to do with my changes from the config, I'll further investigate this.
3. Only happens during build, dev runs fine. (happens right after build is finished)
4. manifest.json

downloading the manifest file from this, also triggers my anti virus

it has something to do with the generated manifest.

[SamHoque]

https://www.virustotal.com/gui/file/6e24e2944f62981d8104d1d6829f6715fef279fdd3f571a4a349a3c8f0232f64

[SamHoque]

Removing either the content, background or sidepanel fixes the bug, but having all 3 causing the bug, I am guessing microsoft is checking for a pattern, maybe the order in how the json is formatted with all 3 of these entry points set.

[SamHoque]

my theory was correct, this is the same file, with just fields in a different order

https://www.virustotal.com/gui/file-analysis/ZTQ3MjVkODFiMmRmMDI3MWJhNGIyYjY2NzA3NDhjMmE6MTczNTA3OTI2Nw==

[aklinker1]

So is it a file hash they're checking? Does your manifest just happen to have the same MD5 or something as a known virus?

[SamHoque]

So is it a file hash they're checking? Does your manifest just happen to have the same MD5 or something as a known virus?

I don't think its a file hash, since unminfied version also gets flagged, I am guessing its the json object order.

[SamHoque]

however, I am rearranging it now, and still seem to be getting virus alerts, very weird.

[SamHoque]

it has something to do with the generated manifest file, the virus defender doesn't like something in it.