.png){kind=logo}
Why does the Motherduck PowerShell install script trigger a Trojan detection on Windows?
Motherduck powershell install script triggers a Trojan detection on windows. whats that all about?
Motherduck powershell install script triggers a Trojan detection on windows. whats that all about?
Hi Abir M., thanks for flagging this. To help us investigate, could you share a few details? 1. The exact command you ran (copy/paste is perfect). For example, was it the MotherDuck install command from our docs (`irm install.motherduck.com | iex`), the DuckDB one, or something else? 2. The domain the script was downloaded from. That's the part of the URL right after https://, like install.motherduck.com or install.duckdb.org. We just want to confirm it came from us. 3. The exact name Defender gave the detection (something like Trojan:Script/...) and which file it flagged. A screenshot works too. Until we've figured out what happened, I'd hold off on re-running the script and leave anything Defender quarantined as is.
Its probably because I should've run it in the CMD/terminal instead maybe?
Thanks for the screenshots! Running it from CMD or another terminal probably won't change anything. You ran the right command, and Defender is flagging the command itself, not where it was run. I'm going to raise this with our team internally and will get back to you as soon as I have something. In the meantime, a bit more context would help us narrow it down:
Is this machine on a work network or VPN, or managed by an IT team?
Do you use any security software besides Windows Defender?
If you can, also send a screenshot of the entry in Windows Security > Protection history for this alert. And I'd hold off on re-running the install command until we've taken a look.
Im running it on my personal computer. There is a wireguard tunnel to my linode VPS but its being split-tunneled to only specific apps. Defender is the only security software installed.
Thanks for the details. One more thing that would help: downloading the install script to a file without running it. That tells us whether the download itself is being blocked or whether the problem only happens when it runs. 1. Open PowerShell (search "PowerShell" in the Start menu). 2. Paste this and press Enter: Invoke-WebRequest https://install.motherduck.com -UseBasicParsing -OutFile install.ps1 3. Then run these, one at a time: Get-Item install.ps1 | Select-Object Length Get-FileHash install.ps1 4. Send me the output of both, or a screenshot. This only saves the file and doesn't run anything. If you see an error, Defender pops up again, or the file isn't found, tell me what you saw, since that's useful too.
FYI, running that install script via cmd works fine. Idk why only poweshell triggers it