Kaspersky Plus flags Remote 0.2.51 dist/index.js as PDM:Trojan.Win32.Generic

[moridai-99]

Summary

Kaspersky Plus on Windows flags Desktop Commander Remote 0.2.51 as:

PDM:Trojan.Win32.Generic

The detection is reported by Kaspersky as behavior analysis, not as a static known-malware signature.

This report is intended to help diagnose a likely AV/EDR compatibility issue. I am not requesting instructions to bypass or disable security controls.

Related: #511 (Microsoft Defender remote-shell alert).

Environment

• Windows
• Node.js: 24.19.0
• Kaspersky Plus: 21.26
• Desktop Commander: @wonderwhy-er/desktop-commander@0.2.51
• Launch method: npx.cmd @wonderwhy-er/desktop-commander@latest remote

Kaspersky detection

Kaspersky reported the object as:

• Detection: PDM:Trojan.Win32.Generic
• Category: Trojan
• Severity: High
• Detection method: Behavior analysis
• Object: dist/index.js
• Process: node.exe

The detected file was under the normal npx cache path for:

node_modules/@wonderwhy-er/desktop-commander/dist/index.js

Kaspersky terminated the process, created a backup, then deleted the object.

Package integrity check

A fresh package was obtained without executing package scripts:

npm.cmd pack @wonderwhy-er/desktop-commander@0.2.51 --ignore-scripts

The tarball printed by npm had SHA-1:

fca73b7d88d0b8c9b9426b37af8584f74494e6f5

Locally re-checking that tarball produced the same SHA-1.

The package/dist/index.js inside that tarball has:

• MD5: 09354a2d602ff53ca237ec4e47747283
• SHA-256: a4145198dc75cd34e7c7452c2054b4cc0d29e199ae1459961a17e4da25a13500
• Size: 6883 bytes

Kaspersky's detection report recorded the same MD5:

09354A2D602FF53CA237EC4E47747283

So the detected dist/index.js matches the freshly downloaded npm package content by MD5.

Repository cross-check

The repository tag v0.2.51 points to commit:

092ce0b841e86455f12e41f4dc36399a7522ecb5

and its package.json identifies:

• package: @wonderwhy-er/desktop-commander
• version: 0.2.51
• CLI entry: dist/index.js

Questions for maintainers

1. Have you seen Kaspersky PDM:Trojan.Win32.Generic or similar behavior detections for Remote mode?
2. Is 0.2.51 expected to trigger AV/EDR behavior monitoring because Remote mode starts/relays local processes?
3. Is there a signed/recommended Windows distribution or install method that reduces false positives?
4. Would you recommend submitting the exact file/hash above to Kaspersky as a false-positive candidate?
5. Are there any additional integrity checks you recommend before resuming use?

Until this is clarified, the detected file is not being allowlisted or excluded from Kaspersky scanning.

[moridai-99]

Additional context after reviewing existing project history:

• In MS Defender flags as remote shell #511, the maintainer explicitly described Defender's remote-shell detection as a false-positive pattern caused by Desktop Commander executing terminal commands.
• PR docs: document MS Defender / antivirus false-positive flagging of Desktop Commander #544 documents the same antivirus/EDR remote-shell false-positive behavior (the PR is documentation-only and is still open).

Our current Kaspersky case is slightly different because Kaspersky names the package entry file itself (dist/index.js) as PDM:Trojan.Win32.Generic via behavior analysis, but the detected MD5 exactly matches the freshly packed official npm package file.

Could you confirm whether you consider this Kaspersky detection the same known false-positive class as #511, and whether you recommend resuming use without AV exclusions, using Docker isolation, or waiting for Kaspersky review?

[moridai-99]

Update: Kaspersky OpenTIP classifies the exact SHA-256 as Malware

I queried Kaspersky Threat Intelligence Portal / OpenTIP for the exact SHA-256 previously reported:

a4145198dc75cd34e7c7452c2054b4cc0d29e199ae1459961a17e4da25a13500

OpenTIP currently returns Malware for this hash.

Observed report details:

• Hits: approximately 10,000
• First seen: 10 Jul 2026
• Last seen: 20 Sep 2026
• Size: 6.72 KB (6883 B)
• MD5: 09354A2D602FF53CA237EC4E47747283
• SHA-1: 0ECF69B2B77730C6BA94C8F9F31B0C9704C711CAC
• SHA-256: A4145198DC75CD34E7C7452C2054B4CC0D29E199AE1459961A17E4DA25A13500

Detection names shown by OpenTIP include:

• BSS:Exploit.Win32.Generic
• BSS:Exploit.Win32.Generic.nblk
• BSS:Trojan.Win32.Generic
• BSS:Trojan.Win32.Generic.nblk
• a not-a-virus:BSS:WebToolbar.Win32.MultiPlug... classification also appears in the history

This changes my local handling decision: I am not allowlisting, restoring, or rerunning Remote mode on the Windows host while this classification remains.

The hash still matches the freshly downloaded npm package's package/dist/index.js, so this appears to concern the distributed artifact itself rather than a local post-download modification.

Please advise whether maintainers consider this a known false positive and whether there is a remediated/signed release or safer supported Windows deployment path.

[wonderwhy-er]

Thanks for the very thorough report. We investigated this from our side as well.

This appears to be in the same broad class of antivirus/EDR false positives we've seen previously with remote-management behavior. We had a similar case with Bitdefender recently; after the detection was submitted to them for review, they removed it.

For this Kaspersky case, we also verified the package integrity independently. The dist/index.js hash you reported matches the official npm package, and rebuilding v0.2.51 from the tagged public source produces a byte-for-byte identical file. So we do not currently see evidence of a modified or compromised npm artifact.

Remote Desktop Commander does perform behavior that security products can reasonably scrutinize: Remote mode maintains a remote connection, starts the local Desktop Commander MCP runtime, and that runtime can launch user-authorized local commands and processes. We have seen similar remote-shell-style detections from other endpoint-security products.

Kaspersky provides both a false-positive reanalysis process and an Allowlist Program for legitimate software vendors, including remote-administration software. We are going to submit the artifact/hash and supporting release information to Kaspersky from our side and work through that process.

For now, we don't recommend disabling Kaspersky or adding a blanket exclusion just to run Desktop Commander. Once we have Kaspersky's review/reclassification, we'll update this issue.

Thanks again for collecting the hashes and detection information — it made investigating this much easier.

Eduards
CEO, Desktop Commander