[Q&A] Why is there a Trojan in this repository?

[Pearson-Research-Student]

What kind of help do you need?

Installation or setup

Your question

[Q&A] Why is there a Trojan in this repository?

Environment and context

No response

What have you already tried?

Not sure what you guys are playing at; but you guys should be arrested for this kind of stuff:

Please explain this: xss跨站脚本.md, was inside the repository folders: which as you know is the PhP attack.
Windows Defender identified Trojan:HTML/Redirector.BQ!atmn and reported DidThreatExecute: false.

Guys like you have ruined GitHub!

Before posting

• I checked the README, FAQ, and relevant docs first.

[sickn33]

Thanks for reporting this. We investigated the files you identified.

They are XSS penetration-testing references containing documented attack examples, including browser redirects and cookie theft. They are not PHP executables. Those examples can trigger antivirus detection, but their presence does not establish that a Trojan was installed or executed. The installer copies these reference files; it does not decode or run those samples.

This was previously reported in #2174 and addressed by #2178. The updated files are available on main and in GitHub tag v20.2.0. The original examples are preserved as Base64 data with explicit authorized-testing warnings. Encoding does not make the decoded examples safe to execute, and we have not yet confirmed the updated files with a fresh Windows Defender scan.

Please note that npm latest still points to 19.15.0, which contains the earlier files.

If the alert persists with the updated GitHub version, please provide the exact commit, full affected path, file SHA-256, and Defender engine/security-intelligence versions. Please keep Defender enabled.

[Pearson-Research-Student]

Nick, Your explanation leaves the practical issue unresolved. You acknowledge that the revised files have not undergone a fresh Defender scan and that npm’s latest release still distributes the earlier files. Changing the GitHub version does not establish that the reported detection is resolved, or change what npm users receive. Please provide: 1. Reproducible Defender results for the revised release, including the tested commit, file hashes and Defender engine/security-intelligence versions. 2. A clear statement of which published releases still contain the reported files, and when the npm release will be updated. 3. A link to the installer code supporting your statement that these examples are copied but never decoded or executed during installation. I accept that an antivirus alert alone does not prove a Trojan executed. However, describing the report as “addressed” needs qualification while validation remains outstanding and the default npm distribution still contains the earlier files. Please distinguish clearly between a code change, a verified outcome and a released fix.