The recommended installation instructions for the node version manager (nvm) are to download and run the install_nvm.sh
bash script, which creates the ~/.nvm
folder, and the nvm script, ~/.nvm/nvm.sh
. On a macOS system protected with SentinelOne anti-malware software this triggers SentinelOne to alert and quarantine (i.e. remove) nvm.sh
.
Does NVM represent in some way a legitimate threat? If not, is there a way to stop SentinelOne from quarantining it?
The affected versions of NVM are 0.39.0, 0.39.1, 0.39.2, 0.39.3 (current, as I write this question).
To reproduce, run the NVM installer script on macOS (13.4).
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash
Look for a SentinelOne (22.4.2.6599) notification message to popup:
"Threat detected. Detected malicious file. File Name nvm.sh"
Edit: more details ...
Using code bisection of nvm.sh, I found that the presence of just two or three lines saved in a file with a .sh extension is sufficient to trigger SentinelOne.
A file with these minimal lines is sufficient to trigger SentinelOne quaratine:
cat > nvm.sh
1166: if command printf "${SEEN_ALIASES}" | nvm_grep -q -e "^${ALIAS_TEMP}$"; then
6416: command chmod +x "${VERSION_PATH}"/node.exe || return 1
OR these three lines:
cat > nvm.sh
5112: printf "%d%06d%06d\n", a[1], a[2], a[3];
6415: command mv "${TMPDIR}/"*/* "${VERSION_PATH}" || return 1
6417: command chmod +x "${VERSION_PATH}"/npm || return 1
I suppose that these lines are not particularly objectionable, but that this is the result of an automatically generated malware signature algorithm.