Repository navigation
Windows Defender report: Win32/Peardis.C #1194
Description
Version
codebase-memory-mcp 0.9.0
Platform
Windows (x64)
Install channel
GitHub release archive / install.sh / install.ps1
Binary variant
standard
What happened, and what did you expect?
Windows defender quarantined my download and reported Trojan:Win32/Peardis.C in codebase-memory-mcp.exe
The file I downloaded was codebase-memory-mcp-windows-amd64.zip from the 0.9.0 release.
Reproduction
Download file on latest Win11 install with Microsoft Defender updates from 17/07/2026.
Logs
Diagnostics trajectory (memory / performance / leak issues)
Project scale (if relevant)
No response
Confirmations
- I searched existing issues and this is not a duplicate.
- My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.
Activity
DeusData commentedon Jul 22, 2026
Thanks for reporting the Defender detection. This is a high-priority
0.9.1-rcWindows security/release issue under #394. Please do not disable or bypass Defender. We will verify the official asset hash against the published release checksums and provenance, reproduce with current Microsoft signatures, and submit the exact artifact for vendor analysis if confirmed. The file SHA-256 plus Defender engine and security-intelligence versions would help distinguish the official asset from a modified or stale download.macdew commentedon Jul 24, 2026
Update: I downloaded the binary again on a secondary machine without our corporate firewall/spyware, and now the Hash of the zip and exe files matches your download pages, so this may have been a one-off on this machine, or your downloads were temporarily affected but are ok now?
For what it's worth, the IT report for the Trojan report reads:
File Name: codebase-memory-mcp-windows-amd64.zip
SHA256 Hash: b4c9c8ce6c4106e6f1f45836e1c73a17d8b3c7f7
Download history shows the resolved Github source URL to be:
DeusData commentedon Jul 24, 2026
Thanks for re-downloading on a clean secondary path. Matching both the official ZIP and executable hashes resolves the immediate question of whether that second download was modified in transit. One detail in the IT extract is still ambiguous: the value labeled SHA256 is 40 hexadecimal characters, while SHA-256 is 64, so it appears truncated or to be a different digest. Please continue to let Defender quarantine the original file rather than bypass it. We will keep the issue in the Windows security queue while treating the clean matching download as strong evidence against a compromised release asset.