0

The recommended installation instructions for the node version manager (nvm) are to download and run the install_nvm.sh bash script, which creates the ~/.nvm folder, and the nvm script, ~/.nvm/nvm.sh. On a macOS system protected with SentinelOne anti-malware software this triggers SentinelOne to alert and quarantine (i.e. remove) nvm.sh.

Does NVM represent in some way a legitimate threat? If not, is there a way to stop SentinelOne from quarantining it?

The affected versions of NVM are 0.39.0, 0.39.1, 0.39.2, 0.39.3 (current, as I write this question).

To reproduce, run the NVM installer script on macOS (13.4).

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash

Look for a SentinelOne (22.4.2.6599) notification message to popup:

"Threat detected. Detected malicious file. File Name nvm.sh"

Edit: more details ...

Using code bisection of nvm.sh, I found that the presence of just two or three lines saved in a file with a .sh extension is sufficient to trigger SentinelOne.

A file with these minimal lines is sufficient to trigger SentinelOne quaratine:

cat > nvm.sh
1166:    if command printf "${SEEN_ALIASES}" | nvm_grep -q -e "^${ALIAS_TEMP}$"; then
6416:    command chmod +x "${VERSION_PATH}"/node.exe || return 1

OR these three lines:

cat > nvm.sh
5112:      printf "%d%06d%06d\n", a[1], a[2], a[3];
6415:      command mv "${TMPDIR}/"*/* "${VERSION_PATH}" || return 1
6417:      command chmod +x "${VERSION_PATH}"/npm || return 1

I suppose that these lines are not particularly objectionable, but that this is the result of an automatically generated malware signature algorithm.

2
  • 1
    Can you whitelist the script - look at the threat in Sentinel One and see if that provides a way to whitelist.
    – John
    Jun 4, 2023 at 20:39
  • I don't see a way to whitelist a threat in SentinelOne, but I'm open to suggestions if someone know how that process is supposed to go. Jun 5, 2023 at 21:38

1 Answer 1

1

This Sentinel One article appears to provide a way.

Sentinel One Whitelist

SentinelOne’s robust exclusion function is easily configured to enable compatibility and remedy interoperability false positives. Exclusions can be applied at the global level, site level and group level for granular control. Blacklisting or whitelisting specific applications is not a requirement in order for the SentinelOne solution to operate. However, it is considered best practices to ensure that no other endpoint security solutions may be conflicting with SentinelOne and thus cause interoperability issues. In such cases, it is advised that customers consider the use of exclusions to deal with 3rd part interoperability conflicts. SentinelOne is happy to discuss mass deployment strategies that include testing for potential interoperability issues and proactively handling them. SentinelOne agent exclusion mechanisms include: • Hash value • Path, path + subfolders, specific executable • Signer certificate identity • File type • Browser type The ability to not monitor certain executables as well as the option to use cascading exclusions. The latter is typically used by shops building code that use known-good compilers. We also have multiple exclusion modes for highly specific (surgical) exclusions. Ability to turn on and off functionality for consideration of different deployment scenarios, including throttling of deployment. All guidelines and knowledge base articles can be access via the online customer portal.

1
  • This seems plausible. I haven't been able to confirm setting up an exclusion as the SentinelOne installation is institutionally managed. I will update when I'm able to confirm that this works. Jun 8, 2023 at 18:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .