SonarLint vscode Plugin flagged as Malware on MAC and Windows both

SonarQube for IDE VS Code
1

  • Operating system: macOS: 26.5.2 (25F84)

  • VS Code plugin version: 5.5.0-darwin-arm64

  • Programming language you’re coding in: Java

  • Is connected mode used:

    • SonarQube Cloud

And a thorough description of the problem / question:
Received a notification and is blocked of the installation.
sonarsource.sonarlint-vscode-5.5.0-darwin-arm64 installed in my VS Code app.

Also, same issue by the windows defender

2

Hello @NitishGo,

Thank you for reporting that the SonarQube for IDE (SonarLint) VS Code extension is being flagged as malware on both macOS and Windows. This is a known issue that has occurred in the past due to heuristic or reputation-based detections by endpoint protection tools. In all previous cases, these detections have been confirmed as false positives, there is no evidence of any actual vulnerability or malicious behavior in the extension or its analyzer components.

To help us escalate this with the relevant antivirus vendors and confirm the false positive, could you please provide:

  • The exact detection name and message
  • The file path and SHA-256 hash of the flagged file
  • The name and version of the antivirus or endpoint protection product
  • A screenshot of the warning, if possible

In the meantime, if your organization’s policy allows, you may add an exception for the extension folder or submit the flagged file to your antivirus vendor as a suspected false positive.

Best regards,

Stevan