Ransomware node detected by sophos when using NextJS
Unanswered
Sloth bear posted this in #help-forum
Sloth bearOP
Sometimes when I am running a NextJS project, I get a warning
Ransomware node detected. /.nvm/versions/node/v18.20/bin/nodeerror: eperm: operation not permitted, open '/projects/.next/server/app-paths-manifest.json'next-server process when I checked the process id in sophos. Any idea on how to resolve this or is it a bug from Nextjs?23 Replies
nvm has nothing to do with nextjs
check that you have the correct read write permissions set
@gin both are different things tho
Sloth bearOP
exactly but it doesn't matter if I have installed node through nvm or installed the binaries, the warning comes in sophos
@gin nvm has nothing to do with nextjs
Sloth bearOP
It is only happening while I'm working with NextJS project
As soon the I get the ransomware warning, thw below error comes in dev server
and this write was by the process
Error: EPERM: operation not permitted, open '/Volumes/Workspace/Projects/test/.next/server/app-paths-manifest.json'and this write was by the process
next-server when I checked which process using ps command@"use php" What antivirus are you using
Sloth bearOP
Sophos Central
You might have to contact the customer support of that antivirus
@Sloth bear As soon the I get the ransomware warning, thw below error comes in dev server
Error: EPERM: operation not permitted, open '/Volumes/Workspace/Projects/test/.next/server/app-paths-manifest.json'
and this write was by the process `next-server` when I checked which process using `ps` command
what user are u running your dev server?
u need to give that user read write permissions
and also delete your .next folder, give the user correct permissions and try again
Your Sophos thing is throwing that warning because the node runtime is saved in the nvm folder
again, has nothing to do why nextjs isnt starting
if u cant do that cause your server is managed by someone else, u need to contact the administrator and tell him to whitelist that folder or give appropriate permissions
@gin and also delete your .next folder, give the user correct permissions and try again
Sloth bearOP
Okay. Will check the permission and try this
@gin and also delete your .next folder, give the user correct permissions and try again
Sloth bearOP
The issue still exists. Sophos crypto guard detects node as ransomware
@gin again, has nothing to do why nextjs isnt starting
Sloth bearOP
Next js projects starts, but the warning is still present
And its not happening with react or other projects using Node
It is happening for NextJS project
I have also tried using NextJS 15, still the same issue
@Sloth bear The issue still exists. Sophos crypto guard detects node as ransomware
Contact antivirus company
@"use php" Contact antivirus company
Sloth bearOP
Okay