Norton quarantine: xurl v1.3.4 Windows x86_64 flagged as Win64:MalwareX-gen [Misc]

Summary and requested precaution

On October 20, 2026, Norton detected and quarantined xurl.exe obtained from the official xdevplatform/xurl v1.3.4 Windows x86_64 release. The detection label in the supplied Norton screenshot is Win64:MalwareX-gen [Misc].

Please investigate this exact release artifact with Norton and review its build provenance. Pending investigation, please consider a prominent Windows-download warning or temporarily suspending the affected asset. If maliciousness is confirmed, please withdraw the artifact and publish an advisory; if it is a false positive, please provide the vendor determination and remediation evidence. Users should not be told to disable antivirus or add exclusions merely because a checksum matches.

This is a confirmed antivirus detection/quarantine report, not a confirmed malware-analysis verdict. There is no evidence here establishing malicious behavior, a compromised repository, or that other versions/platforms are affected. No claim of a Hermes core vulnerability is made.

Artifact identification

• Project: https://github.com/xdevplatform/xurl
• Release: https://github.com/xdevplatform/xurl/releases/tag/v1.3.4
• Release publication timestamp returned by GitHub: 2026-09-29T21:26:08Z.
• Asset: xurl_Windows_x86_64.zip
• Download source: https://github.com/xdevplatform/xurl/releases/download/v1.3.4/xurl_Windows_x86_64.zip
• Archive SHA256: 10c8b96019077100212a44faef6d2256066394b054da3f63d7477e33a2230856
• Extracted xurl.exe SHA256, recorded before quarantine: ed293ebdd170ad1b01c9f68f7fd3086466bf32ab02b4b701cc7224bc4cff9bca
• The archive hash matched both the GitHub release asset digest and the release checksums text. This establishes artifact identity, not safety.

Environment and observed sequence

• Windows 11, AMD64 host.
• Norton product/version and definition version: not collected.
• Norton screenshot shows xurl.exe, detection Win64:MalwareX-gen [Misc], and 10/20/26, 2:50 PM in its local UI.
• The operator explicitly confirmed the item was moved to Norton quarantine.
• During an agent-assisted X publishing setup, the release ZIP was downloaded directly and the single executable extracted into a profile-local tools directory.
• The first attempted command was xurl.exe --version. Process creation failed with PermissionError: [WinError 5] Access is denied.
• A later existence check found the executable missing. A launch attempt then returned WinError 2 (file not found).
• No successful xurl execution, OAuth login, auth-status response, or X API operation was observed in this session. This is not a full-system forensic assessment.

Skill/source context

The existing Hermes xurl skill identified xdevplatform/xurl as its CLI dependency. That installed skill was gated to Linux/macOS. After encountering that gate, the assistant independently consulted the upstream Windows release and downloaded it directly while preparing a separate local publishing workflow. The upstream Hermes skill did not automatically execute a Windows installer in this incident.

This distinction matters: the antivirus detection concerns the identified Windows executable. The broader workflow problem is proceeding with an executable dependency without adequate pre-install security review.

Containment already performed

• Norton quarantine was left intact; the binary was not restored or excluded.
• No antivirus protections were disabled.
• The active-profile xurl skill and the newly created local publishing skill were removed.
• The now-empty profile-local xurl installation directory was removed.
• No binary or ZIP is attached to this report. The supplied screenshot is redacted to remove the personal filesystem path.

Evidence and limitations

Available evidence: the operator's Norton screenshot, recorded SHA256 hashes, release metadata, and the failed process-creation/existence checks. A privacy-redacted screenshot accompanies the local report package and can be attached through an authenticated reporting channel.

Not performed: sample restoration, reverse engineering, independent multi-engine verdict, sandbox execution, a Norton full-system scan, or a complete compromise assessment. We cannot currently classify this as a true positive or false positive.

Questions for maintainers

1. Can you reproduce this Norton detection for the executable SHA256 above?
2. Can you provide build provenance/reproducibility evidence and a vendor investigation result?
3. Will you temporarily warn about or suspend the affected Windows asset while the result is unresolved?
4. Can skill/installation documentation explicitly require security review of executable dependencies and prohibit bypassing antivirus alerts?

Please publish the investigation outcome so users can make an informed decision. Until there is evidence resolving the alert, the reporting operator is leaving the file quarantined and is not reinstalling it.