Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Windows Defender flags Vite+ shim executables as Trojan:Win32/Wacatac.B!ml

Đang mở
  • Có gì không ổn?
#2,866 0 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@fengmk2 đang làm issue này rồi.

Từ ngày 2/10/2026.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
rust
Lĩnh vực
tooling

Hướng nghiên cứu

Start by locating the Windows vp-shim.exe generation and packaging entry points, then reproduce installation or update followed by node -v with Microsoft Defender enabled. Check the generated and extracted shim files named in the report and verify that Defender no longer flags them and that the managed node, npm, and vp commands run successfully.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

pending triage
Describe the bug

On Windows, Microsoft Defender is detecting Vite+'s shim executable as:

Trojan:Win32/Wacatac.B!ml

This causes executables managed/generated by Vite+ such as vp.exe, node.exe, and npm.exe to be blocked by Windows.

For example, running:

node -v

fails with:

ResourceUnavailable: Program 'node.exe' failed to run: An error occurred trying to start process
'C:\Users\MyUser\AppData\Local\vite-plus\bin\node.exe'
with working directory 'C:\Users\MyUser'.

Operation did not complete successfully because the file contains a virus or potentially unwanted software.

The Defender detection history shows that the original vp-shim.exe extracted during Vite+ installation/update is detected as well as copies of that shim:

ThreatID:   2147735505
ThreatName: Trojan:Win32/Wacatac.B!ml
SeverityID: 5
CategoryID: 8

Affected files observed so far include:

C:\Users\MyUser\AppData\Local\vite-plus\bin\vp.exe
C:\Users\MyUser\AppData\Local\vite-plus\bin\npm.exe
C:\Users\MyUser\AppData\Local\vite-plus\bin\node.exe

C:\Users\MyUser\AppData\Local\Temp\vite-platform-1692847142\package\vp-shim.exe
C:\Users\MyUser\AppData\Local\Temp\vite-platform-955851349\package\vp-shim.exe

The SHA-256 hash of my generated Vite+ node.exe shim is:

9FAA32624BDB13526FE4FFFB41BE524CDC4A4659A151BD5D3850739795030DEC

Because Defender also detects the extracted vp-shim.exe itself, this appears to be a false-positive detection of the Vite+ Windows shim rather than a detection of a Node.js runtime downloaded through Vite+.

Expected behavior:

Vite+ installed/managed executables should be usable on a standard Windows system with Microsoft Defender enabled.

Actual behavior:

Microsoft Defender detects the Vite+ shim as Trojan:Win32/Wacatac.B!ml, quarantines or blocks it, and consequently prevents commands such as node, npm, and potentially vp itself from running.

I am reporting this because other Windows users may suddenly lose access to their Vite+ managed toolchain when Microsoft Defender definitions classify the shim this way.

This issue report was prepared with the assistance of ChatGPT. The detection information, file paths, hashes, and command output were obtained from the affected machine; AI was used to help investigate the issue and structure this report according to the Vite+ issue template.

Reproduction

N/A

Steps to reproduce

Command-line reproduction on a Windows machine with Microsoft Defender enabled.

No project repository is required because the detection affects the Vite+ installation/toolchain shim itself.

If the issue template requires a URL, I can provide a minimal repository, but the reproduction does not depend on project contents.

Steps to reproduce

  1. Install or update Vite+ on Windows.
  2. Configure/use Node through Vite+ so that Vite+ provides its node.exe shim under:
%LOCALAPPDATA%\vite-plus\bin
  1. Ensure Microsoft Defender real-time protection and current malware definitions are enabled.
  2. Run:
node -v
  1. Windows may prevent execution with an error similar to:
Operation did not complete successfully because the file contains a virus or potentially unwanted software.
  1. Inspect Defender detections:
Get-MpThreatDetection |
    Sort-Object InitialDetectionTime -Descending |
    Select-Object -First 10 ThreatID, ThreatStatusID, InitialDetectionTime, Resources
  1. Inspect the threat name:
Get-MpThreat |
    Select-Object ThreatID, ThreatName, SeverityID, CategoryID

On the affected system this reports:

ThreatID    ThreatName                   SeverityID CategoryID
--------    ----------                   ---------- ----------
2147735505  Trojan:Win32/Wacatac.B!ml    5          8
  1. Hash the generated Node shim:
Get-FileHash "$env:LOCALAPPDATA\vite-plus\bin\node.exe" -Algorithm SHA256

Result on the affected system:

SHA256
9FAA32624BDB13526FE4FFFB41BE524CDC4A4659A151BD5D3850739795030DEC

Defender additionally reported detections on temporary Vite+ package files named:

...\vite-platform-...\package\vp-shim.exe

which suggests the detection originates from the Vite+ shim itself rather than from the installed Node runtime.

System Info
Node.js:
  Version    24.21.0
  Source     lts
  Bin Path   C:\Users\MyUser\AppData\Local\vite-plus\data\js_runtime\node\24.21.0\node.exe
  Installed  true
  Mode       managed

vp v1.0.0

Local vite-plus:
  vite-plus  Not found

Tools:
  vite             Not found
  rolldown         Not found
  vitest           Not found
  oxfmt            Not found
  oxlint           Not found
  oxlint-tsgolint  Not found
  tsdown           Not found

Environment:
  Package manager  Not found
  Node.js          v24.21.0
Used Package Manager

npm

Logs
Validations
Ngôn ngữ chính
Rust
Star
6k
Fork
274
Merge trung bình
1 ngày 11 giờ
Pull request đã merge (30 ngày)
196

Chuẩn bị môi trường

Mở trong Codespaces

Khởi chạy dev container của dự án ngay trên trình duyệt, bằng tài khoản GitHub của bạn.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của voidzero-dev/vite-plus

Tất cả issue của voidzero-dev/vite-plus

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.