Neovim's Bundled tee.exe Exhibited Suspicious Behavior on Windows 11

2025-02-14
Neovim's Bundled tee.exe Exhibited Suspicious Behavior on Windows 11

While security testing Neovim in a Windows 11 sandbox, the bundled tee.exe binary was flagged as malware. Investigation revealed suspicious DNS lookups and network connections, with one IP address confirmed as malicious by VirusTotal. The author recommends a root cause analysis and suggests building Neovim's dependencies from source to mitigate this security risk.

Development