{{ message }}
Repository navigation
[Bug] Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ v2.86 ] #7207
Description
Client or integration
Codex CLI
Area
CLI
Summary
Kaspersky Premium and VirusTotal detection bun is Trojan.Win32.PEF.pf.silent.77427742
-
ocx.exe [ bun.exe ]
https://www.virustotal.com/gui/file/0c000d764d436d5fc9c14f489c37a6accc1bd4803193dcbe2677b0ee2a67978b -
opencodex-desktop.exe
https://www.virustotal.com/gui/file/586f9d940b9ee755f6da36c99213b3b3f7605ccc1b82a0835dedbeeb64eed3c9
Reproduction
- Click Update on "Update from Desktop app (beta)"
- auto luanch OpenCodex-2.86.0-installer.msi
- Kaspersky Premium detect bun is Trojan.Win32.PEF.pf.silent.77427742
Version
2.86
Operating system
Windows 11 26H2
Provider and model
No response
Logs or error output
Event: Application placed in restricted group
Component: Intrusion Prevention
Name: Trojan.Win32.PEF.pf.silent.77427742
Threat level: Low
Object type: Group of applications
Object name: Low Restricted
Reason: Trust group cannot be definedScreenshots and supporting files
Redacted configuration
Checks
- I searched existing issues and documentation.
- I removed secrets, tokens, account details, request credentials, and personal data.
Activity
[-]OCX v2.86 Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742[/-][+]Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ OCX v2.86 ][/+][-]Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ OCX v2.86 ][/-][+]Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ v2.86 ][/+][-]Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ v2.86 ][/-][+][Bug] Kaspersky Premium and VirusTotal detect "bun" is Trojan.Win32.PEF.pf.silent.77427742 [ v2.86 ][/+]Ingwannu commentedon Oct 16, 2026
Thanks for the report and hashes. The detection is not enough to establish either a false positive or a compromised artifact.
The published v2.86.0 release records SHA-256
6e02ea878cbb387c888b90662bcbabb8d4e63aad2c311e065c417748bd3b39dfforOpenCodex-2.86.0-windows-x64.msi. This is the installer/container hash; it is not supposed to equal either extracted executable hash in your report.Please confirm the download/update source, your downloaded MSI SHA-256, the detected file's basename (redact the user directory), and the antivirus engine/database versions and detection time. Also distinguish a static malware detection from the Intrusion Prevention trust-group event shown in the report. These details let us compare the exact release and embedded Bun/desktop artifacts without guessing.
Keep the protection enabled while this is investigated. I inspected release metadata only; I have not executed/uploaded the binaries, run a malware/security scan, or certified the files as safe.
mean-cj commentedon Oct 16, 2026
Hi @Ingwannu
Testing
1. I'm trying to downgrade to version 2.84.0 and then click the Upgrade button to upgrade to version 2.86.0.
https://github.com/lidge-jun/opencodex/releases/download/v2.84.0/OpenCodex-2.84.0-windows-x64.msi
2. Click Update > Install Update
C:\Users\{USER}\AppData\Local\Temp\OpenCodex-2.86.0-updater-XjZlQL\OpenCodex-2.86.0-installer.msi
The SHA-256 hash of the setup EXE file in the temporary folder appears normal.
SHA-256 6e02ea878cbb387c888b90662bcbabb8d4e63aad2c311e065c417748bd3b39df
https://www.virustotal.com/gui/file/6e02ea878cbb387c888b90662bcbabb8d4e63aad2c311e065c417748bd3b39df
After updated, C:\Program Files\OpenCodex
Version 2.84 > ocx.exe ( bun.exe )
Version 2.84 > opencodex-desktop.exe
Version 2.86 > ocx.exe ( bun.exe )
Version 2.86 > opencodex-desktop.exe
Version 2.86.0 Hash in directory C:\Program Files\OpenCodex
SHA256 0C000D764D436D5FC9C14F489C37A6ACCC1BD4803193DCBE2677B0EE2A67978B
C:\Program Files\OpenCodex\ocx.exe
SHA256 586F9D940B9EE755F6DA36C99213B3B3F7605CCC1B82A0835DEDBEEB64EED3C9
C:\Program Files\OpenCodex\opencodex-desktop.exe
SHA256 0A45935AB21B311FD318055CE0C3FD5EDD87C9A33D9551EE32ED4527CAA6B8C3
C:\Program Files\OpenCodex\Uninstall OpenCodex.lnk
Observations
ocx.exeandopencodex-desktop.exe, using Kaspersky, and no threats were detected.ocx.exeandopencodex-desktop.exein version 2.86.0 as Trojans.Thank you very much !
Ingwannu commentedon Oct 18, 2026
Thank you; the artifact identification requested earlier is now concrete. I rechecked the v2.86.0 GitHub release asset metadata: the official Windows x64 MSI digest is
6e02ea878cbb387c888b90662bcbabb8d4e63aad2c311e065c417748bd3b39df, matching your updater-downloaded MSI. I am removingneeds-infoso the identification request does not trigger idle closure.That match identifies the installer; it does not classify the installed executables as safe or establish Bun as the cause. Your installed
ocx.exeand Desktop hashes, updater path, detection timing, and later local no-detection observation should remain distinct evidence. Existing vendor reports may change independently. Keeping this open for release-maintainer/vendor disposition; I have not submitted/uploaded a sample, started another scan, executed the binaries, or recommended disabling protection.ci(release): sign Windows binaries and MSI via SignPath (#7207) (#7356)