Malwarebytes quarantining Node and NPM

[telemafia]

I was in the middle of programming my website using Node.js and NPM CLI, then all of a sudden Malwarebytes popped up in my bottom-right corner saying it has detected multiple files and quarantined them. Now it's asking me to reboot to finalize the quarantine of the programs.

What is happening? And how do I resolve this?

It is obviously a false-positive and I've used Node.js for about a decade.

[Porthos]

45 minutes ago, telemafia said:

I was in the middle of programming my website using Node.js and NPM CLI,

Until a fix is released, you will have to turn off exploit protection when you working on your site.

[telemafia]

35 minutes ago, NickWoodward said:

So is this looking like a false positive then? Because I got the same thing yesterday

 

Yes it is a false-positive. I have not updated my Node or NPM in a while. It's one of the most used pieces of software in the world. Not any malicious file. And all of a sudden Malwarebytes "detects" it.

 

It stopped detecting it now as I ran an update on Malwarebytes this morning. They seem to have resolved it, for now...

[gmariani405]

JUST ran into this. this happened back on 8/28 and i had to reinstall node. very annoying.

[Arthi]

Hi,

Thank to everyone who reported this issue and worked with us in providing logs, etc. We have now fixed this issue and it is going through internal testing. If everything goes well, we should be releasing the fix in the next 2 weeks or so. Please bear with us. Thank you.

[Porthos]

The beta that was released today has the anti-exploit fix included.

You may get the beta by enabling BETA updates and checking for updates.

This is the version with the fix.

 

[GoatRiderMN]

I had this problem this morning. I tried enabling "beta updates" and checking for updates, it didn't update. Disabling "exploit protection" and un-quarantining the two files fixed got it to work. The two files were "node.exe" and "npm-cli.js".

I'm having a bad case of the Mondays.

[Porthos]

1 minute ago, GoatRiderMN said:

I tried enabling "beta updates" and checking for updates, it didn't update.

What version are you on?

[GoatRiderMN]

1 minute ago, Porthos said:

What version are you on?

4.6.3.281

[gmariani405]

After enabling beta updates, it took a good few minutes before i was able to update to the beta version. I had to have it check for updates a couple of times before it switched. Maybe just give it a minute.

[GoatRiderMN]

1 minute ago, GoatRiderMN said:

4.6.3.281

Err, 4.6.2.281 actually

[Porthos]

Just now, GoatRiderMN said:

Err, 4.6.2.281 actually

Download the following installer and install over what you have now. https://www.malwarebytes.com/mwb-download/thankyou

Then enable beta updates and update again.

[GoatRiderMN]

1 minute ago, gmariani405 said:

After enabling beta updates, it took a good few minutes before i was able to update to the beta version. I had to have it check for updates a couple of times before it switched. Maybe just give it a minute.

OK that seemed to have pulled an update. The "Update package version" is now 1.0.75889.

[Porthos]

Just now, GoatRiderMN said:

OK that seemed to have pulled an update.

But are you on 4.6.4 yet? That is the beta we are looking for.

[GoatRiderMN]

9 minutes ago, Porthos said:

But are you on 4.6.4 yet? That is the beta we are looking for.

Yes. It didn't update right away, I had to wait a couple minutes before it would update.

And it seems to be working now, although does un-quarantining files make them immune from the check?

[Porthos]

1 minute ago, GoatRiderMN said:

And it seems to be working now, although does un-quarantining files make them immune from the check?

If you have restored the files, if the issue was not fixed it would block/quarantine them again.

[GoatRiderMN]

2 minutes ago, Porthos said:

If you have restored the files, if the issue was not fixed it would block/quarantine them again.

OK good, that's what I would expect but I'm making sure. Then I can confirm the beta fixes the issue I was having.