Antivirus blocking GitKrakenCLI/gk.exe for it containing CobaltStrike

[VariableVince]

Description

For the GitLens plugin (18.2.0) which apparently comes by default with gk-cli (3.1.69) i just got a warning from Avast when starting VSCode. It blocked and quarantined AppData/Local/GitKrakenCLI/gk.exe for reason of it containing CobaltStrike Win64:CobaltStrike-A[TrJ]. This never happened before while having GitLens enabled in VSCode.

Socket saying it has potential security risks make this all the more troublesome for me. https://socket.dev/npm/package/%40gitkraken%2Fgk

Probably could have to do with earlier reported issues like gitkraken/vscode-gitlens#4992, which was recently closed. GitKraken CLI is installed and used by GitLens without me being aware of it, hence posting this issue here as well as in the vscode-gitlens repo: gitkraken/vscode-gitlens#5448

GitKraken CLI Version

3.1.69

OS Version

Win 11

Git Version

No response

Logs, Screenshots, Screen Captures, URLs, etc

No response

[JBUinfo]

Hi @VariableVince ,

Thank you for bringing this to our attention and providing the details!

We are highly confident that this is a false positive. According to recent VirusTotal reports from just a few days ago, Avast (and other major engines) flagged this exact binary as completely legitimate. It appears a recent antivirus definition update from Avast is incorrectly triggering this alert.

What we are doing:

Reporting to Avast: We are submitting a false positive dispute to Avast immediately so they can review the binary and update their definitions.

Regarding the Socket.dev warning:
Platforms like Socket.dev run automated static analysis on npm packages. They routinely flag packages that include or execute native compiled binaries (like gk.exe) as a "potential security risk". This is a standard automated alert because binary executables are a black box for their JavaScript scanners, but it is completely expected and necessary behavior for a CLI tool wrapped in an npm package.

We appreciate your patience while we get this sorted out with Avast. We will keep this issue updated as soon as we have news from them!