{
  "schema": "co-link.release-security/1",
  "release": "Standard 0.1.2 / Assistant 0.1.5",
  "source_repository": "https://github.com/ghdtjrtka/co-Link-local-helper",
  "source_commit": "331378a9ef91e48c98962ad1681aec3da7081e94",
  "source_manifest": "https://github.com/ghdtjrtka/co-Link-local-helper/blob/331378a9ef91e48c98962ad1681aec3da7081e94/SOURCE-MANIFEST.json",
  "source_archive": {
    "file": "co-Link-Local-Source-setup012-helper015.zip",
    "sha256": "0e9b8a6569e31b5401dc3bffe762c5169b7fbc86196301f8adc2ae0ead80a1a6",
    "bytes": 83655
  },
  "archive_members_compared_with_distributed_archives": 29,
  "files": [
    {
      "file": "co-Link-Standard-Setup-0.1.2-win-x64.zip",
      "bytes": 20546423,
      "sha256": "86fc01062aa09e021273a54cc95caad6ee4a6afc5787d2956ca4618f37dfd236",
      "download": "/downloads/co-Link-Standard-Setup-0.1.2-win-x64.zip",
      "defender": {
        "result": "no_threats_detected",
        "exit_code": 0,
        "started_at": "2026-10-19T16:30:07.0431303Z",
        "finished_at": "2026-10-19T16:30:20.4610199Z",
        "engine": "1.1.26090.9",
        "definitions": "1.461.98.0",
        "definition_updated": "2026-10-18T21:24:00.0000000Z",
        "mode": "Custom archive scan, remediation disabled"
      },
      "virustotal": {
        "status": "completed",
        "url": "https://www.virustotal.com/gui/file/86fc01062aa09e021273a54cc95caad6ee4a6afc5787d2956ca4618f37dfd236/detection",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 1,
          "harmless": 0,
          "malicious": 2,
          "suspicious": 0,
          "timeout": 5,
          "type-unsupported": 8,
          "undetected": 59
        },
        "analysis_date": 1792428147,
        "flagged": [
          {
            "engine": "Ikarus",
            "category": "malicious",
            "result": "Trojan.Win64.Agent"
          },
          {
            "engine": "Google",
            "category": "malicious",
            "result": "Detected"
          }
        ]
      },
      "availability": "held_pending_detection_review"
    },
    {
      "file": "co-Link-Conversion-Assistant-0.1.5-win-x64.zip",
      "bytes": 24077848,
      "sha256": "f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5",
      "download": "/downloads/co-Link-Conversion-Assistant-0.1.5-win-x64.zip",
      "defender": {
        "result": "no_threats_detected",
        "exit_code": 0,
        "started_at": "2026-10-19T16:30:20.4730752Z",
        "finished_at": "2026-10-19T16:30:30.1765243Z",
        "engine": "1.1.26090.9",
        "definitions": "1.461.98.0",
        "definition_updated": "2026-10-18T21:24:00.0000000Z",
        "mode": "Custom archive scan, remediation disabled"
      },
      "virustotal": {
        "status": "completed",
        "url": "https://www.virustotal.com/gui/file/f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5/detection",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 0,
          "harmless": 0,
          "malicious": 3,
          "suspicious": 0,
          "timeout": 6,
          "type-unsupported": 7,
          "undetected": 59
        },
        "analysis_date": 1792428172,
        "flagged": [
          {
            "engine": "DrWeb",
            "category": "malicious",
            "result": "Trojan.MulDrop36.36111"
          },
          {
            "engine": "Google",
            "category": "malicious",
            "result": "Detected"
          },
          {
            "engine": "Ikarus",
            "category": "malicious",
            "result": "PUA.TamalRoblox"
          }
        ]
      },
      "availability": "held_pending_detection_review"
    }
  ],
  "release_verdict": "review_required",
  "limits": [
    "This local source subset is not the full desktop EXE source.",
    "Antivirus results and hashes do not guarantee absence of malicious or vulnerable code.",
    "The Defender report is developer-published evidence, not a Microsoft certificate.",
    "ZIP scan coverage and unsupported engines differ.",
    "The app is not code-signed yet.",
    "Cloud plan generation/signing, analysis and payment logic remain private."
  ],
  "binary_downloads_held": true,
  "main_executable": {
    "file": "co-Link.exe",
    "sha256": "7657b4c2b40babd4eb811729f0770ee6973b849e012125962366646bf223f705",
    "bytes": 2390016,
    "inside_setup": "86fc01062aa09e021273a54cc95caad6ee4a6afc5787d2956ca4618f37dfd236",
    "defender_result": "no_threats_detected",
    "virustotal": {
      "sha256": "7657b4c2b40babd4eb811729f0770ee6973b849e012125962366646bf223f705",
      "analysis_id": "MGJkNTRmYWQ0MDY3MjcxZWUyNzU4NmJkZTA3Yjk5ZWM6MTc5MjQyODU2Mw==",
      "status": "completed",
      "analysis_date": 1792428563,
      "flagged": [
        {
          "engine": "Trapmine",
          "result": "suspicious.low.ml.score"
        },
        {
          "engine": "Gridinsoft",
          "result": "Trojan.Heur!.02016023"
        }
      ],
      "stats": {
        "confirmed-timeout": 0,
        "failure": 0,
        "harmless": 0,
        "malicious": 2,
        "suspicious": 0,
        "timeout": 0,
        "type-unsupported": 4,
        "undetected": 69
      }
    }
  },
  "component_observations": {
    "results": [
      {
        "container": "86fc01062aa09e021273a54cc95caad6ee4a6afc5787d2956ca4618f37dfd236",
        "sha256": "6b8b33661281e5b2bcd3e6b72106f6a5979b2bdc9fba063a675938878c89bc89",
        "actual_archive_paths": [
          "co-Link-Standard-Setup-0.1.2-win-x64.zip!/co-Link-Standard-Desktop-0.1.2-win-x64.zip"
        ],
        "vt_name": "co-Link-Standard-Desktop-0.1.2-win-x64.zip",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 1,
          "harmless": 0,
          "malicious": 2,
          "suspicious": 0,
          "timeout": 2,
          "type-unsupported": 6,
          "undetected": 64
        },
        "flagged": [
          {
            "engine": "Ikarus",
            "result": "Trojan.Win64.Agent"
          },
          {
            "engine": "Google",
            "result": "Detected"
          }
        ]
      },
      {
        "container": "f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5",
        "sha256": "e5c3c51396e5aeacc5b63d2991623894eb5a6a8981b7aef680e1d0d8af8a4387",
        "actual_archive_paths": [
          "co-Link-Conversion-Assistant-0.1.5-win-x64.zip!/native/vendor/wdi-simple.exe"
        ],
        "vt_name": "wdi-simple.exe",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 1,
          "harmless": 0,
          "malicious": 1,
          "suspicious": 0,
          "timeout": 2,
          "type-unsupported": 4,
          "undetected": 67
        },
        "flagged": [
          {
            "engine": "DrWeb",
            "result": "Trojan.MulDrop36.36111"
          }
        ]
      },
      {
        "container": "f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5",
        "sha256": "0eddec357e283bbc14f3f28731feac5fe802a38443a1b1566766fe94f362b47d",
        "actual_archive_paths": [
          "co-Link-Standard-Setup-0.1.2-win-x64.zip!/co-Link-Standard-Desktop-0.1.2-win-x64.zip!/runtime/python/DLLs/libffi-8.dll",
          "co-Link-Conversion-Assistant-0.1.5-win-x64.zip!/runtime/python/DLLs/libffi-8.dll"
        ],
        "vt_name": "libffi-8.dll",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 1,
          "harmless": 0,
          "malicious": 1,
          "suspicious": 0,
          "timeout": 0,
          "type-unsupported": 4,
          "undetected": 69
        },
        "flagged": [
          {
            "engine": "Cynet",
            "result": "Malicious (score: 100)"
          }
        ]
      },
      {
        "container": "f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5",
        "sha256": "610e254dd43188844b14f0bdc05384a69431b60a755c980b37074f39666bcfaa",
        "actual_archive_paths": [
          "co-Link-Standard-Setup-0.1.2-win-x64.zip!/co-Link-Standard-Desktop-0.1.2-win-x64.zip!/runtime/python/Lib/venv/scripts/nt/pythonw.exe",
          "co-Link-Conversion-Assistant-0.1.5-win-x64.zip!/runtime/python/Lib/venv/scripts/nt/pythonw.exe"
        ],
        "vt_name": "py.exe",
        "stats": {
          "confirmed-timeout": 0,
          "failure": 1,
          "harmless": 0,
          "malicious": 1,
          "suspicious": 0,
          "timeout": 2,
          "type-unsupported": 4,
          "undetected": 67
        },
        "flagged": [
          {
            "engine": "Trapmine",
            "result": "malicious.moderate.ml.score"
          }
        ]
      }
    ],
    "pagination": [
      {
        "sha256": "86fc01062aa09e021273a54cc95caad6ee4a6afc5787d2956ca4618f37dfd236",
        "http": 200,
        "hasMore": false
      },
      {
        "sha256": "f3e844f8a0c30948c926693da1b9cc12f0dee5473c716977141bb4b067cd58c5",
        "http": 200,
        "hasMore": true
      }
    ]
  },
  "upstream_byte_match": {
    "upstream": "raspberrypi/usbboot",
    "commit": "0fd2663f869b7f325f4481049c60d6394855260e",
    "path": "win32/redist/wdi-simple.exe",
    "bytes": 7346688,
    "sha256": "e5c3c51396e5aeacc5b63d2991623894eb5a6a8981b7aef680e1d0d8af8a4387",
    "matches_distributed_file": true,
    "safety_verdict": "not established by byte match"
  },
  "python_upstream_byte_match": {
    "publisher": "Astral python-build-standalone",
    "release": "20260414",
    "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260414/cpython-3.11.15%2B20260414-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
    "archive_sha256": "71ffdf290e0483f0881e02518ecb9cedb449807856ae7dc76aa630e5acd00919",
    "archive_digest_verified": true,
    "files": [
      {
        "path": "DLLs/libffi-8.dll",
        "source_member": "python/DLLs/libffi-8.dll",
        "sha256": "0eddec357e283bbc14f3f28731feac5fe802a38443a1b1566766fe94f362b47d",
        "matches_distributed_runtime": true
      },
      {
        "path": "Lib/venv/scripts/nt/pythonw.exe",
        "source_member": "python/Lib/venv/scripts/nt/pythonw.exe",
        "sha256": "610e254dd43188844b14f0bdc05384a69431b60a755c980b37074f39666bcfaa",
        "matches_distributed_runtime": true
      },
      {
        "path": "python.exe",
        "source_member": "python/python.exe",
        "sha256": "fee5ed8687d7e24ac045d833ecd1963396357988bc1d741212b8f372d0cf327a",
        "matches_distributed_runtime": true
      },
      {
        "path": "python311.dll",
        "source_member": "python/python311.dll",
        "sha256": "79434e33ee4a548f5d5201478407531220f99b84132c9c760abb0ae60741450a",
        "matches_distributed_runtime": true
      }
    ],
    "safety_verdict": "Upstream byte identity established; no vendor false-positive confirmation obtained"
  }
}