Trojan Detected in datascience-ui

[thisisayush]

Environment data

• VS Code version: 1.33.1.
• Extension version (available under the Extensions sidebar): 2019.4.11987
• OS and version: WIN 10
• Python version (& distribution if applicable, e.g. Anaconda): 3.6
• Type of virtual environment used (N/A | venv | virtualenv | conda | ...): virtualenv
• Relevant/affected Python packages and their versions:

Expected behavior

Work Fine? I don't know, have a trojan free code.

Actual behavior

Steps to reproduce:

1. Update extension to the latest version with Avast File Shield ON.

[hciudad]

Can verify same behavior with Avast on Mac OS.

[thepartisan101]

Same here, updated and detected with the same BitcoinMiner.
Using Avast on Windows 10

[cmoad]

Same here. Avast on Mac OS 10.14.4.

[pds1979]

Same here

[TheRobBrennan]

Same here

[rchiodo]

Not sure how that file is being flagged. We don't even use it in the extension. It's a test file.

[rchiodo]

Our internal scans should have caught the index_bundle.js file that's included. So maybe it's just a red herring.

[davidskuza]

It's on Avast for everybody so it can be a false positive just in that particular AV. Paths in index.html were changed to Mac style (compared to previous versions of that file) and that would match with "MacOS:" part.

[rchiodo]

We're going to flag this with Avast and see what they say. The file itself is rather simple, and the index_bundle.js checks out as clear on https://www.virustotal.com/#/home/upload

[rchiodo]

I can't repro this on Windows 10.

Anybody that's having this problem, can you report back your Avast version number? I'm using this one:

[IanMatthewHuff]

Hey everyone. I've contacted Avast with the index.html file and they have currently stated that the file is not flagged by their system. If anyone who is reproing this issue can, could you upload the index.html file up on this post? I used the index.html from the download site to sent to Avast and I just want to make 100% sure that it's the same file as folks that are having this issue have.

[IanMatthewHuff]

I just heard back from Avast seems like this warning has actually been totally disabled. Here is their reply:

Hi Ian and thank you for your reply,

Using the provided discussion, I noticed that the file was detected as "MacOS:BitCoinMiner-EL [Trj]." I checked our database and this detection was actually disabled completely just yesterday and it should not occur anymore.

We are sorry for any inconvenience this may have caused. If you have any further questions, don't hesitate to contact me again.

Best Regards,
Prokop
The Avast Support Team

Sounds like no one should be seeing this if they are updated as of today with Avast.