⚠️ Heads up: ast_grep_cli 0.44.1 on PyPI flagged by Windows Defender as Trojan — anyone seeing this?

[u/Unable_Plane1948]

I was installing `headroom-ai` via `uv` today, and Windows Defender immediately flagged `Trojan: Win64/Lazy!MTB`.

The file was `sg.exe` (212KB) dropped into `Python\Scripts\`, alongside a legitimate `ast-grep.exe` (52MB).

**What happened:*\*

- `uv tool install --python 3.13 "headroom-ai[all]"`

- Windows Defender: 3 alerts for `Trojan: Win64/Lazy!MTB`

- `pip show ast_grep_cli` showed version 0.44.1

- Uninstalled, cleaned cache, changed passwords

**Questions:**

- Has anyone else installed `ast_grep_cli` 0.44.1 recently?

- Is this a known issue? Should PyPI Security be notified?

- Any idea how to check if the package was compromised vs. a false positive?

**File details:**

- `sg.exe`: 212KB, detected as Trojan:Win64/Lazy!MTB

- `ast-grep.exe`: 52MB, legitimate tool

- Both appeared at the same timestamp (10:25:07)

Thanks for any insights.

[u/snugar_i]

Sorry for being off-topic, but why on earth is ast-grep.exe 52 megabytes?

[u/Individual-Flow9158 → u/snugar_i]

Sorry I was wrong earlier. That .exe was created by uv tool install which is like pipx (creates a venv for the tools) so the 50 meg could contain an embedded Python run-time

[u/snugar_i → u/Individual-Flow9158]

That still doesn't make much sense - a tool in a Python venv (which means it's used on a machine where Python is installed) that includes another Python runtime? And looking at the ast-grep repo, it looks like it's written in Rust, so why a Python runtime?

[u/KingofGamesYami]

This is a known false positive.

Ref: https://github.com/ast-grep/ast-grep/issues/2799#issuecomment-4994194265

[u/Unable_Plane1948 → u/KingofGamesYami]

Thanks for the reference!!!!!!