electron-builder: NSIS and nsis-web Installers are being detected as: Suspicious.Win32.Save.a false positives with VirusTotal

@mmaietta For the time being if we can somehow replace/remove the use of nsis-resources-3.4.1 it compiles correctly with nsis-3.0.5.0.

The nsis needs to be recompiled with both extended length strings and debug flags enabled. The hard part is finding a device to do it, it didn’t compile for me.

Tried to figure out how to do that within app-builder-lib/nsisTarget.js but I didn’t succeed… I do have an intel mac to use or maybe Github actions could be of help.

Do you know, and if so, can you share what needs to be compiled for me to give it a shot?

ps. there is a brew of makensis for arm64 if that helps

@mmaietta NSIS is the issue. I got it to work without the trojan warning by downgrading the NSIS version to 3.0.4.1.

This can be done by adding the following to the build configuration in the project’s package.json:

        "nsis": {
            "customNsisBinary": {
                "url": "https://github.com/electron-userland/electron-builder-binaries/releases/download",
                "checksum": "VKMiizYdmNdJOWpRGz4trl4lD++BvYP2irAXpMilheUP0pc93iKlWAoP843Vlraj8YG19CVn0j+dCo/hURz9+Q==",
                "version": "3.0.4.1"
            }
        },

3.0.5.0 is not working due to a build error.

@develar can you please advise here?

• What is winshell.dll being used for in nsis-resources? Is it needed for something specific?
• Can we get it from elsewhere? (I haven’t found any) As the current Sourceforge download link has this Suspicious.Win32.Save.a detection in the payload.

@cliqer , thanks for all your investigative work here, I really appreciate it. We can use nsis-3.0.5 for sure, but I’m not sure if that completely removes the need for nsis-resources. If you’re willing to, I’d be happy to review a PR on the nsis update! Setting up a local dev environment is pretty simple: https://github.com/electron-userland/electron-builder/blob/master/CONTRIBUTING.md#to-setup-a-local-dev-environment

Thank you @mmaietta & @develar.

I see that there is a new tag nsis-3.0.5.0 binary available: https://github.com/electron-userland/electron-builder-binaries/releases/tag/nsis-3.0.5.0

When extracted the plugins folder does not contain WinShell.dll and, after checking each of these files with virustotal, they are not getting flagged.

Any chance this is the solution and that the NSIS binary just needs to be replaced within electron-builder?