Oh-my-posh3: Windows Security blocks/quarantined posh-windows-amd64.exe

[audunn]

Prerequisites

• [x] I have read and understand the CONTRIBUTING guide
• [x] I looked for duplicate issues before submitting this one

Description

[Description of the bug or feature]
Windows Security block v3.48.0, I can see it in the protection history flagged as threat blocked or quarantined.

From the protection history:
Threat detected: Behavior:Win32/DefenseEvasion.UM!ml
Alert Level: Severe
Category: Suspicious Behavior
Details: This program is dangerous and executes commands from an attacker.
Affected item: posh-windows-amd64.exe

Environment

• Oh my Posh version: v3.48.0
• Theme: Agnoster
• Operating System: Windows 10 1909
• Shell: powershell
• Terminal: Windows Terminal

Steps to Reproduce

1. [First Step]
   Update to latest Update-Module -Name oh-my-posh -AllowPrerelease -Scope CurrentUser

2. [Second Step]
   Launch new window

3. After uninstallation and retry install

Package 'oh-my-posh' failed to be installed because: Operation did not complete successfully because the file contains a virus or potentially
      | unwanted software. : 'C:\Users\***\AppData\Local\Temp\ycx0wff3\bin\posh-windows-amd64.exe'

Expected behavior: [What you expected to happen]
prompt runs without issue

Actual behavior: [What actually happened]
prompt not running, posh-windows-amd64.exe is removed from directory

[JanDeDobbeleer]

We've seen this before but there's nothing I can do to mitigate that as far as I'm aware. Maybe there's a way to sign this and become accepted but on my own machine for example that doesn't happen.

[audunn]

BTW reverted to 3.46.1 it is working fine

[JanDeDobbeleer]

Let me do a diff and have a look what might trigger this.

[JanDeDobbeleer]

@audunn can you check if 3.47.0 works? That's the only one which does something "new" as in execute http requests, which might be the cause.

[audunn]

Hi, I tried that and my very unscientific testing revealed nothing. In fact so much nothing that I am now completely unable to reproduce this on any version and tried several. Currently on latest 3.49 and working fine.
Don't know what to tell you to be honest. But that is where we are at.

[JanDeDobbeleer]

I'll close this then until it pops up again.