Kaspersky detects official hapi.exe as Trojan.Win64.Agent.smghfc

[DolphinZZZZZ]

Description

Kaspersky File Anti-Virus detected and deleted the official Windows x64 hapi.exe binary as a Trojan.

The detected file appears to be the official binary from the npm package @twsxtd/hapi-win32-x64@0.18.4.

Environment

• OS: Windows
• Package: @twsxtd/hapi-win32-x64
• Version: 0.18.4
• Binary: bin/hapi.exe
• Antivirus: Kaspersky

Kaspersky detection details

Application name: node.exe
Component: File Anti-Virus
Result description: Deleted
Type: Trojan
Name: Trojan.Win64.Agent.smghfc
Accuracy: Exact
Threat level: High
Object type: File
Object name: hapi.exe
Object MD5: 6489ABDAC9AC440363E1C51EB30829D7

Verification

I downloaded the official npm tarball:

https://registry.npmjs.org/@twsxtd/hapi-win32-x64/-/hapi-win32-x64-0.18.4.tgz

The npm package integrity checks matched the registry metadata.

Official npm package SHA1:

540b988f30d636b17f67a8c51f0c69c3ea8d8c3bf

Downloaded package SHA1:

540b988f30d636b17f67a8c51f0c69c3ea8d8c3bf

Extracted official package/bin/hapi.exe:

MD5:    6489ABDAC9AC440363E1C51EB30829D7
SHA1:   63818b9cceb3ef9d5ccbc1dad5031e7ef48051ef
SHA256: dbb954e9ef0172f0c14d2e82d7754043cbc200a1d4e82e63a72078b22d68ef08

The MD5 matches the file deleted by Kaspersky, so this appears to be a false positive against the official binary.

Request

Could you please confirm whether this binary is expected and consider reporting this false positive to Kaspersky or documenting the recommended workaround?

[github-actions]

Thanks for the detailed hashes. From the repo, the Windows x64 binary/package is expected: the main @twsxtd/hapi package for 0.18.4 declares @twsxtd/hapi-win32-x64 as an optional dependency, the launcher resolves that package and executes bin/hapi.exe, and the npm packaging script creates the win32-x64 package with bin/hapi.exe copied from the Windows build output.

I cannot independently verify the MD5/SHA values from the source tree because the published npm tarball / extracted .exe is not checked into this repo. I also did not find existing Kaspersky/antivirus-specific workaround documentation in the repo. Based on the packaging code, the file path/package name you reported matches the expected official Windows x64 distribution path; the detection report and hashes should be enough for maintainers to submit a false-positive report to Kaspersky.

Relevant code:

• cli/package.json:28 - main package optional dependencies include platform packages, including @twsxtd/hapi-win32-x64 at 0.18.4.
• cli/bin/hapi.cjs:28 - win32-x64 is listed as a supported platform.
• cli/bin/hapi.cjs:41 - launcher resolves @twsxtd/hapi-${platform}-${arch} and uses hapi.exe on Windows.
• cli/scripts/prepare-npm-packages.ts:53 - npm platform config defines win32-x64 with binName: 'hapi.exe'.
• cli/scripts/prepare-npm-packages.ts:89 - generated platform package name is @twsxtd/hapi-${platform.name} and its bin entry points to bin/${platform.binName}.
• cli/scripts/prepare-npm-packages.ts:177 - packaging copies the built Windows executable from dist-exe/bun-windows-x64/hapi.exe into the npm package bin/hapi.exe.
• cli/scripts/build-executable.ts:5 - default all-platform executable targets include bun-windows-x64.
• cli/scripts/build-executable.ts:207 - executable build emits hapi.exe for win32 targets using Bun --compile.

---

HAPI Bot

[tiann]

I believe this is a false positive. I just built it using cross-compilation, and I don't have a Windows machine to verify it.