Investigate ESET detection of the Windows native package

[teng-lin]

Upstream migration

Migrated from the archived upstream report: thewh1teagle/rookie#99

Original reporter: @chirsz-ever

Problem

ESET identified an archived @rookie-rs/api Windows native binary as a Win64/PSW.Agent variant. This may have been a heuristic false positive, but the result was not reproduced or cleared. The maintained fork now publishes under rookie-cookies, so current artifacts need an independent check.

Confirmation requested

@chirsz-ever, if possible, please scan a current fork-built Windows artifact and report:

• the exact rookie-cookies version and artifact filename
• SHA-256 of the scanned file
• ESET product and signature/database version
• exact detection name and whether ESET still flags it

Do not execute or redistribute any artifact you believe is malicious.

Completion criteria

• Reproduce or rule out the detection against a current, checksum-identified artifact.
• Verify the artifact corresponds to the tagged source and release workflow.
• If reproduced, minimize the triggering code/build characteristic and submit the artifact through the vendor's false-positive process when appropriate.
• Document checksums and the final vendor disposition.

[teng-lin]

Investigation update (2026-08-14; no binaries executed or uploaded):

Current npm Windows native target — rookie-cookies-win32-x64-msvc@0.5.8

• tarball: https://registry.npmjs.org/rookie-cookies-win32-x64-msvc/-/rookie-cookies-win32-x64-msvc-0.5.8.tgz
• tarball SHA-256: 400eace0919c62507e0546383cfea2ebecdc9b6b8ef2a04be4fda5e928e1416d
• embedded rookie_cookies.win32-x64-msvc.node (5,801,984 bytes) SHA-256: 27c124ddd4825c404127f44df5191c8c2da6c706cffc156921d48ff3f02a7810
• npm attestations: https://registry.npmjs.org/-/npm/v1/attestations/rookie-cookies-win32-x64-msvc@0.5.8 (npm publish + SLSA provenance; GitHub-hosted builder; publish workflow run 31526096557 attempt 4). The successful Windows job checked out immutable tag v0.5.8 at 5eaf1464abc55bd9ae67026fe656816d7d1929f9.

Current Windows CLI asset — rookie-cookies-cli-x86_64-pc-windows-msvc.exe v0.5.8

• SHA-256: 4fb633a0e3b2686351accfc6d831057d5b37fe55f075b63ee1cf6005f32c3f9e, matching the GitHub release asset digest.
• No GitHub artifact attestation was found (gh attestation verify returned 404), so scan the CLI separately from the npm native module.

The archived report omitted a version/hash, so its exact sample cannot be reconstructed. The likely historical package (@rookie-rs/api-win32-x64-msvc@0.5.6) has a different name, size, source, and binary SHA-256 (4989423a5bf615d73b882c19c864646f651cd863313d2912fd860049da7c467d), so the old detection cannot establish the current fork artifact’s status. Static PE inspection found both native modules unsigned (zero PE Security Directory); the current module adds expected ncrypt.dll imports for CNG support. That neither proves malware nor proves a false positive.

Safe next step: keep open until a disposable, fully updated Windows VM with current ESET scans the checksum-verified current npm module and CLI without loading/executing them. Record ESET product/engine/signature version and exact detection. If detected, the maintainer should submit that exact checksum-identified sample through ESET’s official false-positive process: https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab . Close only after a current scan is clean or ESET confirms/reclassifies it.