Sonar cloud jar identified as a trojan

SonarQube Cloud
1

We have a problem because our corporate antivirues detect a sonarcloud jar as a Trojan

sonarcloud-scanner-engine-13.10.0.46578071466299458153456jar;49,9 MB;ESET LiveGuard Troyano; SHA-1:F26075E65D4FE7F605813703741D2037AFC06EDB

  • ALM used (Azure DevOps)
  • CI system used (Azure DevOps)
2

Hi @manuel-valino,

Thanks for reporting this. The file is the SonarQube Cloud scanner engine, which the scanner downloads and caches during analysis. It might be flagged as malware due to a hash collision, and therefore we might need to submit a false positive report to ESET so that it won’t flag it. Could you please provide:

  • The full ESET LiveGuard detection report, including the detection name/reason and detection URL, if available.
  • The SHA-256 checksum of the quarantined file (in addition to the SHA-1 already provided).
4

I think this are the data {
“filename”: “sonarcloud-scanner-engine-13.10.0.4657.jar”,
“sha256”: “64dc46b240b0af21ce846a3b77447f598fda533c0f734c90af887308794a7226”,
“downloadUrl”: “https://scanner.sonarcloud.io/engines/sonarcloud-scanner-engine-13.10.0.4657.jar”
}

I can’t get the full report only this message:02/09/2026 13:38:11;Protección del sistema de archivos en tiempo real;archivo;C:\Users\Services.sonar\cache_tmp\sonarcloud-scanner-engine-13.10.0.465710159929925795494693jar;ESET LiveGuard Troyano;desinfectado por eliminación;…\Services;Se produjo un suceso en un nuevo archivo creado por la aplicación: C:\Program Files\Java\jdk-17\bin\java.exe (CB023C7E0BFB3FD295D519D104D04E26852AB2DD).;F26075E65D4FE7F605813703741D2037AFC06EDB;31/08/2026 12:35:24;S-1-5-21-3317265532-3053341197-3715880546-3763;…;f0ijQshBf0wOrQ+zrV+yaQ==

5

Hi @manuel-valino,

After reaching out to ESET, they confirmed this was wrongly marked as a Trojan.
It will be fixed in the next update of the ESET detection engine (33798).

Thanks.