Windows Defender report: Win32/Peardis.C

[macdew]

Version

codebase-memory-mcp 0.9.0

Platform

Windows (x64)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

Windows defender quarantined my download and reported Trojan:Win32/Peardis.C in codebase-memory-mcp.exe

The file I downloaded was codebase-memory-mcp-windows-amd64.zip from the 0.9.0 release.

Reproduction

Download file on latest Win11 install with Microsoft Defender updates from 17/‎07/‎2026.

Logs

Diagnostics trajectory (memory / performance / leak issues)

Project scale (if relevant)

No response

Confirmations

• I searched existing issues and this is not a duplicate.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.

[DeusData]

Thanks for reporting the Defender detection. This is a high-priority 0.9.1-rc Windows security/release issue under #394. Please do not disable or bypass Defender. We will verify the official asset hash against the published release checksums and provenance, reproduce with current Microsoft signatures, and submit the exact artifact for vendor analysis if confirmed. The file SHA-256 plus Defender engine and security-intelligence versions would help distinguish the official asset from a modified or stale download.

[macdew]

Update: I downloaded the binary again on a secondary machine without our corporate firewall/spyware, and now the Hash of the zip and exe files matches your download pages, so this may have been a one-off on this machine, or your downloads were temporarily affected but are ok now?

For what it's worth, the IT report for the Trojan report reads:
File Name: codebase-memory-mcp-windows-amd64.zip
SHA256 Hash: b4c9c8ce6c4106e6f1f45836e1c73a17d8b3c7f7

Download history shows the resolved Github source URL to be:

https://release-assets.githubusercontent.com/github-production-release-asset/1166102148/02529ac6-fa56-467e-840c-7f4628a75fe4?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-07-20T13%3A05%3A39Z&rscd=attachment%3B+filename%3Dcodebase-memory-mcp-windows-amd64.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-07-20T12%3A04%3A57Z&ske=2026-07-20T13%3A05%3A39Z&sks=b&skv=2018-11-09&sig=ZvBnvTY3PQ8eGFZCS6RUMx406OS%2BZ9Si%2FZKDr8En48E%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NDU1MTg1MywibmJmIjoxNzg0NTUwMDUzLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.4JylLoj2MNiumJ32Vne2J7H3K219qGzA2Gfuh4KkzOc&response-content-disposition=attachment%3B%20filename%3Dcodebase-memory-mcp-windows-amd64.zip&response-content-type=application%2Foctet-stream

[DeusData]

Thanks for re-downloading on a clean secondary path. Matching both the official ZIP and executable hashes resolves the immediate question of whether that second download was modified in transit. One detail in the IT extract is still ambiguous: the value labeled SHA256 is 40 hexadecimal characters, while SHA-256 is 64, so it appears truncated or to be a different digest. Please continue to let Defender quarantine the original file rather than bypass it. We will keep the issue in the Windows security queue while treating the clean matching download as strong evidence against a compromised release asset.