[Package Issue]: ElyPrismLauncher.ElyPrismLauncher

[stinyc]

Please confirm these before moving forward

• I have searched for my issue and not found a work-in-progress/duplicate/resolved issue.
• I have not been informed if the issue is resolved in a preview version of the winget client.

Category of the issue

Other

Brief description of your issue

Installing PrismLauncher.PrismLauncher and then running winget export displays that ElyPrismLauncher.ElyPrismLauncher is installed instead. Also, running winget upgrade --all installs ElyPrismLauncher.ElyPrismLauncher as if it was an update to Prism Launcher: ElyPrismLauncher/ElyPrismLauncher#71

Steps to reproduce

1. Run winget install --id PrismLauncher.PrismLauncher
2. Run winget upgrade --all

Actual behavior

ElyPrismLauncher.ElyPrismLauncher and PrismLauncher.PrismLauncher are installed.

Expected behavior

PrismLauncher.PrismLauncher should only be installed, not ElyPrismLauncher.ElyPrismLauncher.

Environment

Windows Package Manager v1.10.390
Copyright (c) Microsoft Corporation. All rights reserved.

Windows: Windows.Desktop v10.0.22631.5189
System Architecture: X64
Package: Microsoft.DesktopAppInstaller v1.25.390.0

Winget Directories
-----------------------------------------------------------------------------------------------------------------------
Logs                               %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\Diag…
User Settings                      %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\sett…
Portable Links Directory (User)    %LOCALAPPDATA%\Microsoft\WinGet\Links
Portable Links Directory (Machine) C:\Program Files\WinGet\Links
Portable Package Root (User)       %LOCALAPPDATA%\Microsoft\WinGet\Packages
Portable Package Root              C:\Program Files\WinGet\Packages
Portable Package Root (x86)        C:\Program Files (x86)\WinGet\Packages
Installer Downloads                %USERPROFILE%\Downloads
Configuration Modules              %LOCALAPPDATA%\Microsoft\WinGet\Configuration\Modules

Links
---------------------------------------------------------------------------
Privacy Statement   https://aka.ms/winget-privacy
License Agreement   https://aka.ms/winget-license
Third Party Notices https://aka.ms/winget-3rdPartyNotice
Homepage            https://aka.ms/winget
Windows Store Terms https://www.microsoft.com/en-us/storedocs/terms-of-sale

Admin Setting                             State
--------------------------------------------------
LocalManifestFiles                        Disabled
BypassCertificatePinningForMicrosoftStore Disabled
InstallerHashOverride                     Disabled
LocalArchiveMalwareScanOverride           Disabled
ProxyCommandLineOptions                   Disabled
DefaultProxy                              Disabled

Screenshots and Logs

No response

[Dragon1573]

✅ Successfully reproduced.

Console logs

--> Injecting proxy settings from the host
    --> Injecting with WinHTTP

Current WinHTTP proxy settings:

    Proxy Server(s) :  http://alist.dragon1573.local:57890
    Bypass List     :  <local>,*.local,*.cn

    --> Injecting with Windows Registry


ProxyEnable   : 1
ProxyServer   : http://alist.dragon1573.local:57890
ProxyOverride : <local>,*.local,*.cn



--> Installing WinGet
--> Disabling safety warning when running installers
Tip: you can type 'Update-EnvironmentVariables' to update your environment variables, such as after installing a new software.

--> Configuring Winget
已启用管理员设置 'LocalManifestFiles'。
已启用管理员设置 'LocalArchiveMalwareScanOverride'。
已启用管理员设置 'ProxyCommandLineOptions'。
将管理员设置 'DefaultProxy' 设置为 'http://alist.dragon1573.local:57890'。

--> Running the following script: {
$(Get-Content -Path $BoundParameterScript.FullName)
}

“msstore”源要求在使用前查看以下协议。
Terms of Transaction: https://aka.ms/microsoft-store-terms-of-transaction
源要求将当前计算机的 2 个字母的地理区域发送到后端服务才能正常工作，(例如"US")。

已找到 Prism Launcher [PrismLauncher.PrismLauncher] 版本 9.4
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
此包需要以下依赖项：
  - 程序包
      Microsoft.VCRedist.2015+.x64
(1/1) 已找到 Microsoft Visual C++ 2015-2022 Redistributable (x64) [Microsoft.VCRedist.2015+.x64] 版本 14.44.35211.0
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
正在下载 https://download.visualstudio.microsoft.com/download/pr/73aabf2e-9532-4f68-99f7-3247081a619c/CC0FF0EB1DC3F5188AE6300FAEF32BF5BEEBA4BDD6E8E445A9184072096B713B/VC_redist.x64.exe
  ██████████████████████████████  24.4 MB / 24.4 MB
已成功验证安装程序哈希
正在启动程序包安装...
已成功安装

正在下载 https://github.com/PrismLauncher/PrismLauncher/releases/download/9.4/PrismLauncher-Windows-MSVC-Setup-9.4.exe
  ██████████████████████████████  21.2 MB / 21.2 MB
已成功验证安装程序哈希
正在启动程序包安装...
已成功安装
名称           ID                                版本          可用          源
-----------------------------------------------------------------------------------
Microsoft Edge Microsoft.Edge                    137.0.3296.83 137.0.3296.93 winget
Prism Launcher ElyPrismLauncher.ElyPrismLauncher 9.4           9.5           winget
2 升级可用。

正在安装依赖项:
此包需要以下依赖项：
  - 程序包
      Microsoft.VCRedist.2015+.x64
(1/1) 已找到 ElyPrismLauncher [ElyPrismLauncher.ElyPrismLauncher] 版本 9.5
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
正在下载 https://github.com/ElyPrismLauncher/ElyPrismLauncher/releases/download/9.5/ElyPrismLauncher-Windows-MSVC-Setup-9.5.exe
  ██████████████████████████████  21.3 MB / 21.3 MB
已成功验证安装程序哈希
正在启动程序包安装...
已成功安装

[Dragon1573]

Can't sure why they matched together. 😕

Console logs

--> Injecting proxy settings from the host
    --> Injecting with WinHTTP

Current WinHTTP proxy settings:

    Proxy Server(s) :  http://alist.dragon1573.local:57890
    Bypass List     :  <local>,*.local,*.cn

    --> Injecting with Windows Registry


ProxyEnable   : 1
ProxyServer   : http://alist.dragon1573.local:57890
ProxyOverride : <local>,*.local,*.cn



--> Installing WinGet
--> Disabling safety warning when running installers
Tip: you can type 'Update-EnvironmentVariables' to update your environment variables, such as after installing a new software.

--> Configuring Winget
已启用管理员设置 'LocalManifestFiles'。
已启用管理员设置 'LocalArchiveMalwareScanOverride'。
已启用管理员设置 'ProxyCommandLineOptions'。
将管理员设置 'DefaultProxy' 设置为 'http://alist.dragon1573.local:57890'。

--> Running the following script: {
$(Get-Content -Path $BoundParameterScript.FullName)
}

“msstore”源要求在使用前查看以下协议。
Terms of Transaction: https://aka.ms/microsoft-store-terms-of-transaction
源要求将当前计算机的 2 个字母的地理区域发送到后端服务才能正常工作，(例如"US")。

已找到 Prism Launcher [PrismLauncher.PrismLauncher] 版本 9.4
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
此包需要以下依赖项：
  - 程序包
      Microsoft.VCRedist.2015+.x64
(1/1) 已找到 Microsoft Visual C++ 2015-2022 Redistributable (x64) [Microsoft.VCRedist.2015+.x64] 版本 14.44.35211.0
此应用程序由其所有者授权给你。
Microsoft 对第三方程序包概不负责，也不向第三方程序包授予任何许可证。
正在下载 https://download.visualstudio.microsoft.com/download/pr/73aabf2e-9532-4f68-99f7-3247081a619c/CC0FF0EB1DC3F5188AE6300FAEF32BF5BEEBA4BDD6E8E445A9184072096B713B/VC_redist.x64.exe
  ██████████████████████████████  24.4 MB / 24.4 MB
已成功验证安装程序哈希
正在启动程序包安装...
已成功安装

正在下载 https://github.com/PrismLauncher/PrismLauncher/releases/download/9.4/PrismLauncher-Windows-MSVC-Setup-9.4.exe
  ██████████████████████████████  21.2 MB / 21.2 MB
已成功验证安装程序哈希
正在启动程序包安装...
已成功安装
----- Section seperator -----

DisplayName                                                        DisplayVersion Publisher                   ProductCode                            Scop
                                                                                                                                                     e
-----------                                                        -------------- ---------                   -----------                            ----
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211 14.44.35211.0  Microsoft Corporation       {d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} M...
Prism Launcher                                                     9.4            Prism Launcher Contributors PrismLauncher                          User


PS C:\Users\WDAGUtilityAccount\Desktop\winget-pkgs>
>> winget update --accept-source-agreements
名称           ID                                版本          可用          源
-----------------------------------------------------------------------------------
Microsoft Edge Microsoft.Edge                    137.0.3296.83 137.0.3296.93 winget
Prism Launcher ElyPrismLauncher.ElyPrismLauncher 9.4           9.5           winget
2 升级可用。

Differences

diff --git a/manifests/p/PrismLauncher/PrismLauncher/9.4/PrismLauncher.PrismLauncher.locale.en-US.yaml b/manifests/e/ElyPrismLauncher/ElyPrismLauncher/9.4/ElyPrismLauncher.ElyPrismLauncher.locale.en-US.yaml
index 11a39217619..600c6ff9ef2 100644
--- a/manifests/p/PrismLauncher/PrismLauncher/9.4/PrismLauncher.PrismLauncher.locale.en-US.yaml
+++ b/manifests/e/ElyPrismLauncher/ElyPrismLauncher/9.4/ElyPrismLauncher.ElyPrismLauncher.locale.en-US.yaml
@@ -1,28 +1,28 @@
-# Created using wingetcreate 1.9.4.0
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.9.0.schema.json
+# Created with komac v2.12.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.10.0.schema.json
 
-PackageIdentifier: PrismLauncher.PrismLauncher
-PackageVersion: "9.4"
+PackageIdentifier: ElyPrismLauncher.ElyPrismLauncher
+PackageVersion: '9.4'
 PackageLocale: en-US
-Publisher: Prism Launcher Contributors
-PublisherUrl: https://prismlauncher.org
-PublisherSupportUrl: https://github.com/PrismLauncher/PrismLauncher/issues
-Author: Prism Launcher Contributors
-PackageName: Prism Launcher
-PackageUrl: https://github.com/PrismLauncher/PrismLauncher
+Publisher: ElyPrismLauncher
+PublisherUrl: https://elyprismlauncher.github.io/
+PublisherSupportUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher/issues
+Author: ElyPrismLauncher Contributors
+PackageName: ElyPrismLauncher
+PackageUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher
 License: GPL-3.0
-LicenseUrl: https://github.com/PrismLauncher/PrismLauncher/blob/develop/LICENSE
-Copyright: Copyright (C) 2022 Prism Launcher Contributors
-ShortDescription: A custom launcher for Minecraft that allows you to easily manage multiple installations of Minecraft at once
-Moniker: prismlauncher
+LicenseUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher/blob/develop/LICENSE
+Copyright: © 2022-2025 Prism Launcher Contributors\n© 2021-2022 PolyMC Contributors\n© 2012-2021 MultiMC Contributors
+CopyrightUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher/blob/develop/COPYING.md
+ShortDescription: This fork of Prism Launcher adds integrated support for Ely.by accounts.
 Tags:
-- fabricmc
+- authlib-injector
+- elyby
+- launcher
 - minecraft
-- minecraft-launcher
 - multimc
+- multimc5
 - polymc
-- prism
 - prismlauncher
-ReleaseNotesUrl: https://github.com/PrismLauncher/PrismLauncher/releases/tag/9.4
 ManifestType: defaultLocale
-ManifestVersion: 1.9.0
+ManifestVersion: 1.10.0

diff --git a/manifests/p/PrismLauncher/PrismLauncher/9.4/PrismLauncher.PrismLauncher.installer.yaml b/manifests/e/ElyPrismLauncher/ElyPrismLauncher/9.4/ElyPrismLauncher.ElyPrismLauncher.installer.yaml
index 1b02c018227..7b4e357bd7c 100644
--- a/manifests/p/PrismLauncher/PrismLauncher/9.4/PrismLauncher.PrismLauncher.installer.yaml
+++ b/manifests/e/ElyPrismLauncher/ElyPrismLauncher/9.4/ElyPrismLauncher.ElyPrismLauncher.installer.yaml
@@ -1,27 +1,35 @@
-# Created using wingetcreate 1.9.4.0
-# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.9.0.schema.json
+# Created with komac v2.12.0
+# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.10.0.schema.json
 
-PackageIdentifier: PrismLauncher.PrismLauncher
-PackageVersion: "9.4"
+PackageIdentifier: ElyPrismLauncher.ElyPrismLauncher
+PackageVersion: '9.4'
+InstallerLocale: en-US
 InstallerType: nullsoft
+Scope: user
 InstallModes:
 - interactive
 - silent
 - silentWithProgress
 UpgradeBehavior: install
+ProductCode: ElyPrismLauncher
+ReleaseDate: 2025-04-13
+AppsAndFeaturesEntries:
+- Publisher: ElyPrismLauncher Contributors
+  ProductCode: ElyPrismLauncher
+InstallationMetadata:
+  DefaultInstallLocation: '%LocalAppData%\Programs\ElyPrismLauncher'
 Installers:
 - Architecture: x64
-  InstallerUrl: https://github.com/PrismLauncher/PrismLauncher/releases/download/9.4/PrismLauncher-Windows-MSVC-Setup-9.4.exe
-  InstallerSha256: 15F8C7DC20BC98E803270C21125AC3F8178FBABAE7BDF142C5C2F5596802342D
+  InstallerUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher/releases/download/9.4/ElyPrismLauncher-Windows-MSVC-Setup-9.4.exe
+  InstallerSha256: B3F73438476E7E482369195E7F62B566512E5D9B2D54BEE0B13A87828448D4DA
   Dependencies:
     PackageDependencies:
     - PackageIdentifier: Microsoft.VCRedist.2015+.x64
 - Architecture: arm64
-  InstallerUrl: https://github.com/PrismLauncher/PrismLauncher/releases/download/9.4/PrismLauncher-Windows-MSVC-arm64-Setup-9.4.exe
-  InstallerSha256: 1E0B70CDA81DD2AB3FF9935C74FE29C96D4FFB19CF9B66CCFD82D9766BF0C2DE
+  InstallerUrl: https://github.com/ElyPrismLauncher/ElyPrismLauncher/releases/download/9.4/ElyPrismLauncher-Windows-MSVC-arm64-Setup-9.4.exe
+  InstallerSha256: A286296B4C7D2D8BF6403276A4FE3EAE6BC3DB90017D71F8F8B1189413047AC9
   Dependencies:
     PackageDependencies:
     - PackageIdentifier: Microsoft.VCRedist.2015+.arm64
 ManifestType: installer
-ManifestVersion: 1.9.0
-ReleaseDate: 2025-04-07
+ManifestVersion: 1.10.0

[timoreo22]

Adding a few more details, seems to match the ProductCode to be PrismLauncher
while it's not present in the 9.4 version file, it is present in the 8.4 versions and earlier

This issue is also quite important since it affects upgrades, someone who has installed PrismLauncher 9.4 will be offered to upgrade to the other package

Console logs

>winget search prismlauncher
Name             Id                                Version Match                      Source
--------------------------------------------------------------------------------------------
ElyPrismLauncher ElyPrismLauncher.ElyPrismLauncher 9.5     ProductCode: prismlauncher winget
Prism Launcher   PrismLauncher.PrismLauncher       9.4     Moniker: prismlauncher     winget


>winget install -e PrismLauncher.PrismLauncher
Found Prism Launcher [PrismLauncher.PrismLauncher] Version 9.4
This application is licensed to you by its owner.
Microsoft is not responsible for, nor does it grant any licenses to, third-party packages.
This package requires the following dependencies:
  - Packages
      Microsoft.VCRedist.2015+.x64
Downloading https://github.com/PrismLauncher/PrismLauncher/releases/download/9.4/PrismLauncher-Windows-MSVC-Setup-9.4.exe
  ██████████████████████████████  21.2 MB / 21.2 MB
Successfully verified installer hash
Starting package install...
Successfully installed

>winget upgrade
Name                                             Id                                  Version       Available     Source
-----------------------------------------------------------------------------------------------------------------------
Prism Launcher                                   ElyPrismLauncher.ElyPrismLauncher   9.4           9.5           winget

[ZekeZDev]

Has this happened before with other winget packages?

I am trying to gauge the severity, in this case its quite mundane I don't believe ElyPrismLauncher is a malicious fork. However the fact that winget can allow for forks or possibly even unrelated packages to overwrite updates and install the wrong version without user prompt is a seriously scary security issue.

Is there anything stopping someone from making a malicious git fork and winget then replacing users installs with that?

[felipecrs]

I believe there should be some kind of PR verification in the winget-pkgs repository to ensure that a package whose Product Code is already used by some other existing package cannot be introduced.

Tagging @denelon for visibility.