False positive: Kaspersky flags bundled Vite JS inside Codex app.asar as HEUR:Trojan.Script.Generic

What version of the Codex App are you using (From “About Codex” dialog)?

26.609.3341.0 (x64)

What subscription do you have?

Plus

What platform is your computer?

Windows x64

What issue are you seeing?

Summary

Kaspersky Plus (with up-to-date databases) flags an internal JavaScript bundle shipped inside the Codex desktop app as HEUR:Trojan.Script.Generic. This looks like an antivirus false positive on Codex's own bundled code, but it interrupts use and risks the file being quarantined, which could break the app.

Regression

This detection is new in this version. It appeared immediately after updating Codex via the Microsoft Store to 26.609.3341.0 — the previously installed version did not trigger any Kaspersky detection. Something in this build's bundled JS is newly tripping the heuristic.

Detected object

C:\Program Files\WindowsApps\OpenAI.Codex_26.609.3341.0_x64__2p2nqsd0c76g0\app\resources\app.asar\.vite\build\src-GT0gjTeg.js

Detection details

Engine: Kaspersky Plus (heuristic engine). Verdict: HEUR:Trojan.Script.Generic. Time: 6/12/2026 1:03 PM. Virus databases: up to date.

Notes

The flagged file is a Vite-built JS bundle living inside the signed MSIX package (app.asar), not a user-introduced file. This matches a known AV false-positive pattern for Codex — Windows Defender has similarly flagged a Codex browser-automation file (see #20315). Filing so the bundled code can be reviewed and/or submitted to AV vendors for whitelisting.

Screenshot of the Kaspersky detection attached below.

<img width="1919" height="667" alt="Image" src="https://github.com/user-attachments/assets/092a33b6-f062-44ad-8a97-08c32acc1288" />

What steps can reproduce the bug?

Steps: Install the Codex desktop app (MSIX package) on Windows x64 with Kaspersky Plus and real-time protection enabled, then launch/use Codex so the bundled app.asar files are read from disk. Kaspersky's file anti-virus scans the bundle and raises HEUR:Trojan.Script.Generic on app.asar\.vite\build\src-GT0gjTeg.js.

Expected: the bundled, signed Codex JS is not flagged as malware.

Actual: Kaspersky reports the file as a Trojan and prompts to resolve/quarantine it, which could remove a required app file.

What is the expected behavior?

_No response_

Additional information

_No response_