{"action":"created","issue":{"url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/86","labels_url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/86/labels{/name}","comments_url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/86/comments","events_url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/86/events","html_url":"https://github.com/mikaelbr/node-notifier/issues/86","id":123814428,"number":86,"title":"\"Notifu\" package appears to be infected.","user":{"login":"iowillhoit","id":1715111,"avatar_url":"https://avatars.githubusercontent.com/u/1715111?v=3","gravatar_id":"","url":"https://api.github.com/users/iowillhoit","html_url":"https://github.com/iowillhoit","followers_url":"https://api.github.com/users/iowillhoit/followers","following_url":"https://api.github.com/users/iowillhoit/following{/other_user}","gists_url":"https://api.github.com/users/iowillhoit/gists{/gist_id}","starred_url":"https://api.github.com/users/iowillhoit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iowillhoit/subscriptions","organizations_url":"https://api.github.com/users/iowillhoit/orgs","repos_url":"https://api.github.com/users/iowillhoit/repos","events_url":"https://api.github.com/users/iowillhoit/events{/privacy}","received_events_url":"https://api.github.com/users/iowillhoit/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mikaelbr/node-notifier/labels/Can't%20Reproduce","name":"Can't Reproduce","color":"fbca04"},{"url":"https://api.github.com/repos/mikaelbr/node-notifier/labels/Invalid","name":"Invalid","color":"ffffff"},{"url":"https://api.github.com/repos/mikaelbr/node-notifier/labels/Security","name":"Security","color":"e11d21"}],"state":"closed","locked":false,"assignee":{"login":"mikaelbr","id":606374,"avatar_url":"https://avatars.githubusercontent.com/u/606374?v=3","gravatar_id":"","url":"https://api.github.com/users/mikaelbr","html_url":"https://github.com/mikaelbr","followers_url":"https://api.github.com/users/mikaelbr/followers","following_url":"https://api.github.com/users/mikaelbr/following{/other_user}","gists_url":"https://api.github.com/users/mikaelbr/gists{/gist_id}","starred_url":"https://api.github.com/users/mikaelbr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikaelbr/subscriptions","organizations_url":"https://api.github.com/users/mikaelbr/orgs","repos_url":"https://api.github.com/users/mikaelbr/repos","events_url":"https://api.github.com/users/mikaelbr/events{/privacy}","received_events_url":"https://api.github.com/users/mikaelbr/received_events","type":"User","site_admin":false},"milestone":null,"comments":13,"created_at":"2015-12-24T15:38:32Z","updated_at":"2016-01-12T21:02:01Z","closed_at":"2016-01-06T13:47:59Z","body":"We run [ClamAV](http://www.clamav.net) nightly on our servers. Last night we had 13 reports of malicious `notifu.exe` files. \r\n\r\nOur `notifu.exe` files have not been modified for a while, I would guess that ClamAV just added a check for this worm last night. \r\n\r\nExample Reports:\r\n```\r\n/home/USERNAME/www/wp-content/themes/Sun/node_modules/gulp-notify/node_modules/node-notifier/vendor/notifu/notifu.exe: Win.Worm.Chir-2815 FOUND\r\n/home/USERNAME/www/api/node_modules/laravel-elixir/node_modules/gulp-notify/node_modules/node-notifier/vendor/notifu/notifu.exe: Win.Worm.Chir-2815 FOUND\r\n```\r\n\r\nI did a quick search and found that apparently this file is known to be malicious:\r\nhttps://www.reasoncoresecurity.com/notifu.exe-22a6a9191ea8c6d7cc6ee552e8dfda485e53c1ed.aspx\r\n\r\nNotice the \"Common path\":\r\n`C:\\users\\{user}\\appdata\\local\\temp\\{random}.tmp\\node_modules\\node-notifier\\vendor\\notifu\\notifu.exe`\r\n\r\nI ran `openssl sha1 [file]` on every `notifu.exe` to get a checksum and they returned one of two results. Neither of which is listed on the reasoncoresecurity.com site above.\r\n```\r\nec1dc5fb10718afb1201ba2ddd4ab69fa62ff1f4\r\n5529988a429a0af159d28260059309db668f0e31\r\n```\r\n\r\nI also tried updating node-notifier to 4.4.0, but the SHA1 was the same and ClamAV still reported it malicious.\r\n\r\nPlease let me know if you need any more information from me.\r\n\r\nThanks\r\n\r\n "},"comment":{"url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/comments/171053333","html_url":"https://github.com/mikaelbr/node-notifier/issues/86#issuecomment-171053333","issue_url":"https://api.github.com/repos/mikaelbr/node-notifier/issues/86","id":171053333,"user":{"login":"flohdot","id":918747,"avatar_url":"https://avatars.githubusercontent.com/u/918747?v=3","gravatar_id":"","url":"https://api.github.com/users/flohdot","html_url":"https://github.com/flohdot","followers_url":"https://api.github.com/users/flohdot/followers","following_url":"https://api.github.com/users/flohdot/following{/other_user}","gists_url":"https://api.github.com/users/flohdot/gists{/gist_id}","starred_url":"https://api.github.com/users/flohdot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flohdot/subscriptions","organizations_url":"https://api.github.com/users/flohdot/orgs","repos_url":"https://api.github.com/users/flohdot/repos","events_url":"https://api.github.com/users/flohdot/events{/privacy}","received_events_url":"https://api.github.com/users/flohdot/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T21:02:01Z","updated_at":"2016-01-12T21:02:01Z","body":"Zillya is still/now marking notifu.exe as infected. Verified using their app directly as well. I contacted their support, it might help if other interested parties do the same. \r\n\r\nhttps://www.virustotal.com/en/file/511adc6c5f1fdf45cc0e266b7ab052c64f4620fed3c982e23d8e3c2f49c8a818/analysis/1452632219/"}}