Trojan horse found in lastest Windows install

[Iwooo000]

Version

latest

Platform

Web (browser)

Bug Description

Trojan horse found in lastest Windows install. DO NOT INSTALL

Steps to Reproduce

download latest windows package and run it thru antivirus

Expected Behavior

is this a sscam?

Screenshots / Recordings

No response

Additional Context

No response

[Kayshen-X]

All of the code is publicly available. If you have any security concerns, please feel free to review it yourself and share any specific findings with us.

[Kayshen-X]

Thanks for the report — this is a heuristic false positive, not a trojan. No need to worry, but you're right to check before trusting an installer.

Why it gets flagged:

• Every OpenPencil release is a brand-new binary with a brand-new hash. Reputation-based engines (SmartScreen, cloud AV heuristics) score files by prevalence, so a fresh release from a small project starts at zero reputation.
• The app ships in an NSIS installer, a format some AV heuristics weight negatively because malware droppers have abused it.
• The installer is not yet signed with a CA-issued Authenticode certificate, so Windows shows "Unknown publisher" and the AV gets no trust signal to offset the heuristics. A proper certificate is on the roadmap.

Why you can trust the binaries: every release asset is built from the public source in GitHub Actions and uploaded directly by CI (github-actions[bot]) — no human ever touches them. You can audit the exact pipeline in .github/workflows/rust-release.yml, or build from source yourself (cargo build -p op-host-desktop --release).

What we're shipping to make this verifiable: starting with the next release, every asset will come with a SHA256SUMS.txt manifest and a signed build-provenance attestation you can check with:

gh attestation verify OpenPencil-<version>-x64-win-setup.exe --repo ZSeven-W/openpencil

There's also a new doc covering this in detail: docs/security/antivirus-false-positives.md.

If you can share which antivirus engine and detection name flagged it (e.g. Wacatac.B!ml), that would help — we submit false-positive reports to vendors so the warning disappears for everyone. You can also report it directly to Microsoft here: https://www.microsoft.com/en-us/wdsi/filesubmission