It is a Trojan false alarm, introduce by &quot;pyinstaller&quot;
The software is opensource, feel free to review&#x2F;compile it: <a href="https:&#x2F;&#x2F;github.com&#x2F;sipeed&#x2F;MetaSense-ComTool" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sipeed&#x2F;MetaSense-ComTool</a>
<a href="https:&#x2F;&#x2F;github.com&#x2F;Neutree&#x2F;COMTool&#x2F;issues&#x2F;40" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Neutree&#x2F;COMTool&#x2F;issues&#x2F;40</a>
<a href="https:&#x2F;&#x2F;github.com&#x2F;pyinstaller&#x2F;pyinstaller&#x2F;issues&#x2F;4852" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;pyinstaller&#x2F;pyinstaller&#x2F;issues&#x2F;4852</a>

Sipeed is a Chinese hardware manufacturer known for embedded AI systems, RISC-V development boards, and edge computing modules (K210 AI accelerators, MaixSense ToF cameras, LicheeRV boards). They&#x27;re fairly established in the maker and embedded systems community.I downloaded their official COMTools utility (serial communication tool for device configuration) directly from their distribution server at dl.sipeed.com - the link provided in their official documentation.Multiple security scanners are flagging it as trojan malware:VirusTotal: https:&#x2F;&#x2F;www.virustotal.com&#x2F;gui&#x2F;file&#x2F;66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8&#x2F;detectionHybrid Analysis: https:&#x2F;&#x2F;hybrid-analysis.com&#x2F;sample&#x2F;66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8&#x2F;690e6b0ff38090310e09c79dMore concerning than the detections is the observed behavior:
- Random cmd.exe processes spawning periodically
- Persistent background activity
- BitLocker recovery triggered after offline virus scan
- Suspicious network connectionsThis goes beyond typical false-positive behavior seen with some Chinese development tools (which sometimes lack proper code signing or use aggressive system access).Two possibilities:
1. Supply chain compromise - their dl.sipeed.com server is serving modified binaries
2. Aggressive false positive (seems less likely given the behavioral indicators)I&#x27;m currently comparing SHA256 hashes between the website version and their GitHub releases to determine if there&#x27;s a discrepancy.If this is a supply chain attack, it could affect a significant portion of the embedded systems development community, particularly those working with AI edge devices and RISC-V systems.I&#x27;ve reported to Sipeed, Microsoft Security, and various security researchers. Has anyone else in the HN community used Sipeed products and can verify their COMTools installation?SHA256 of flagged file: 66b9b83687f4579e0de629eb63b9d41ef0c3cc2e4f03546d0fe6374de76c69f8
Official (potentially compromised) source: https:&#x2F;&#x2F;dl.sipeed.com&#x2F;shareURL&#x2F;MaixSense&#x2F;MaixSense_A010&#x2F;software_pack&#x2F;comtool

Supply Chain Alert: Sipeed's Official COMTools Software Flagged as Trojan