Wincrypt is marked as potential malware during installation via chocolatey

[yacoob]

Not a bug per-se, just wanted to let you know:

PS C:\windows\system32> choco install wincrypt-sshagent
Chocolatey v0.10.15 Professional
Installing the following packages:
wincrypt-sshagent
By installing you accept licenses for the packages.
Progress: Downloading wincrypt-sshagent 1.1.7... 100%

wincrypt-sshagent v1.1.7 [Approved]
wincrypt-sshagent package files install completed. Performing other installation steps.
Downloading wincrypt-sshagent 64 bit
  from 'https://github.com/buptczq/WinCryptSSHAgent/releases/download/v1.1.7/WinCryptSSHAgent.exe'
Using download CDN cache instead of original url.
Progress: 100% - Completed download of 'WinCryptSSHAgent.exe' (4.05 MB).
Download of 'WinCryptSSHAgent.exe' (4.05 MB) completed.
Virus check: 3/70 scan engines flagged this assembly.
 Due to possible false positives we fail at 4 minimum positives.
 Virus scan engine 'Bkav' found potential 'W32.AIDetect.malware1'.
 Virus scan engine 'Cylance' found potential 'Unsafe'.
 Virus scan engine 'APEX' found potential 'Malicious'.
Hashes match.

VirusTotal also shows APEX marking the exe file as suspicious. Probably a false positive... right? :)

[BUPTCZQ]

I think it is a a false positive, WinCryptSSHAgent is built by github action.

[Andrew]

On a somewhat related note, I think Avast Antivirus also marks this as malware.

[Lars The]

And Google Chrome too!