Neovim's Bundled tee.exe Exhibited Suspicious Behavior on Windows 11
2025-02-14
While security testing Neovim in a Windows 11 sandbox, the bundled tee.exe binary was flagged as malware. Investigation revealed suspicious DNS lookups and network connections, with one IP address confirmed as malicious by VirusTotal. The author recommends a root cause analysis and suggests building Neovim's dependencies from source to mitigate this security risk.
Development