Intego Virusbarrier on macOS shows Homebrew build of John 1.9.0_1 as containing a crypto miner

[gdecuba]

I have updated my home-brew and got an alert on John 1.9.0_1 that it contained malware.

14/11/2025, 15:20:06 | File added to quarantine (PUA:OSX/CoinMiner.ext!s1;MV-17396/9a2eb9d8): Macintosh HD ▸ private ▸ tmp ▸ homebrew-unpack-20251114-5112-7chprv ▸ john-jumbo ▸ 1.9.0_1 ▸ share ▸ john ▸ john

/opt/homebrew/Cellar/john-jumbo/1.9.0_1/share/John/john

[solardiz]

Thank you for letting us know.
What anti-malware software is that, is it a standard feature of macOS or something external you installed?
Do you suggest we do anything about this, and what exactly?

[gdecuba]

Intego Virusbarrier

[solardiz]

Thanks. Perhaps as their customer, you're the one to report this false positive to them?

[gdecuba]

VirusTotal report for sample.pdf

[solardiz]

Thanks. What sample is this VirusTotal report for?

I see it lists 6 URLs. One of those is JtR homepage. 3 others are actually part of test vectors we have for a MySQL format. Checking git history, I was the one to add them in 2012 via 567bf74. Unfortunately, I made no comment on where I got them from. If they're confusing anti-virus scanners now, perhaps we should drop them. The final 2 "URLs" are concatenations of two of these test vector passwords/URLs with their corresponding ciphertexts.

[solardiz]

I went to these 3 password URLs - they don't correspond to any working websites now. Also this report appears to give them no weight. So they're probably fine to keep. The DNS servers and IP addresses mentioned probably came from elsewhere in the sandbox (probably parts of the OS). Overall, the report says the score is 2/100 and the verdict is "Non Malicious". So this isn't a false positive.

If you say Intego Virusbarrier flagged this same file, then indeed please report this to Intego. Thank you!

Also please note that we're not involved with Homebrew project and the brew build of JtR, but there's no indication there's anything wrong with the build wrt this virus detection anyhow.

I'll close this issue for now as there's nothing for us to do on it. Looks like the only tasks are for you to report this to Intego and for them to fix their product.

Thanks again.

[solardiz]

File added to quarantine (PUA:OSX/CoinMiner

BTW, "PUA" means "potentially unwanted application", which means they don't claim virus nor malware - just something you may not want to have. Like you write, they suspect it's a miner. I don't know exactly why, but a guess is that our Monero wallet password recovery code by its nature includes implementation of an algorithm that Monero had also used for their proof-of-work many years ago - they reused the same algorithm to protect their wallet, so we have to reproduce it to be able to test passwords against such wallets. But this guess could as well be wrong. We do have many mentions of wallets and cryptocurrency names in our projects, any of this could trigger something. So maybe Intego's check should be revised from "contains code that a miner would also contain" to "ditto and is not a wallet password cracker". But then they could label password crackers as another kind of PUA, like some others actually do. :-(