Virus warning when installing using Homebrew

[KieranConlon]

Upgrading my homebrew packages this morning, aws-sdk-cpp upgrading from 1.11.360 --> 1.11.375 and libaws-cpp-sdk-ssm-quicksetup.dylib files was quarantined by my virus scanner before it could be installed.
Looking-up details for OSX/PSW.ext it would appear to be a password stealer trojan.

Has the community seen this before?

[sbiscigl]

just tried to repro by sending the dylib to virus total and it seems to be finding nothing. could you try uploading your dylib to virus total and see if you get a different result?

[KieranConlon]

Just some additional info, in case it is useful.
This install of aws-sdk-cpp is a dependency of another packakge.

The top-level package I installed is gdal, which has a dependency on apache-arrow which has dependency on aws-sdk-cpp.

[DmitriyMusatkin]

I would try again with virustotal, its one of the more comprehensive tools out there.

In general there are 2 possibilities here:

1. VirusBarrier has a false a positive in their definitions
2. There is an active campaign to insert malicious stuff into binary distributions of cpp sdk

Given, virustotal does not flag anything in our runs on homebrew and manually build dyn lib. And also given that VirusBarrier seems to run into false positives quite often based on quick online research. I would guess that 1 is much more probable than 2. In which case it is more of a bug for VirusBarrier to address.

[KieranConlon]

Tried to analyse with Virus Total again and got a result this time - no issues found.

So, could be a false positive with VirusBarrier.

[sbiscigl]

submitted a report with them to mark as false positive

[KieranConlon]

submitted a report with them to mark as false positive

I did too, earlier today.

[KieranConlon]

I just got a reply from Intego's malware detection team and they confirm that this virus warning was a false positive.
Intego have already released an update to their malware definitions, on Aug-8th.
Re-scanning with the latest updates does not give any alert/warning.

Response from Intego…

Our malware detection team confirmed this was not malware and added the file's necessary signature to ensure the latest malware definitions do not detect these updates, ensuring any false positive detections.