False positive alert for Versio.io OneImporter from MS Defender

An aggressive AI heuristic detection triggered a false alert for Trojan:AIGen/NPMStealer.B. Here is what happened and how to apply the fix to your environments

In a nutshell Request demo Start free trial

Problem

Recently, several of our users reached out with reports of Microsoft Defender flagging the Versio OneImporter file kubernetes.js as Trojan:AIGen/NPMStealer.B. We appreciate the rapid communication from the community, which allowed our team to investigate the behavior immediately.

Analysis

After a thorough technical review, we can confirm that this detection is strictly a false positive.

The alert in question-identifying kubernetes.js as Trojan:AIGen/NPMStealer.B being triggered by Microsoft Defender's AI-based heuristic engine. This engine is currently exhibiting aggressive behavior and incorrectly categorizing standard Node.js code patterns used within our application as malicious.

We want to be absolutely clear on a few critical points regarding the security of your Versio.io deployments:

No Security Compromise - There has been no supply-chain compromise. There is no malicious code within the OneImporter software or any of its dependencies.
Environments Are Secure - Your infrastructure remains completely secure. The flagged file is harmless, and the software is operating exactly as intended.

While the file itself poses zero threat, we fully understand that ongoing alerts from Windows Defender are disruptive to your operations and generate unnecessary noise for your security teams.

To resolve this issue permanently, we have released a new update for the Versio OneImporter. In this latest release, we have adjusted the underlying Node.js module to prevent Microsoft Defender's AI engine from incorrectly flagging the code patterns going forward.

Recommended Action

From a security perspective, no action is required, as this is a false positive error message.

To suppress the false positive error message, we recommend updating all your Versio OneImporter installations to the latest version. Installing this update provides the modified file in a version that Windows Defender no longer incorrectly flags.

If your security team requires further technical details regarding this heuristic false positive, or if you need assistance applying the update in your environment, please contact our support team. We will be happy to assist you.