r/PowerShell • u/Practical_Toe6724 • 12d ago

Question Powershell update legit/scam?

Does anyone knows a github user jshigetomi ? Is he legit or scam? my antivirus software/drivers updater said I need to update my Powershel Core (x64) to 7.6.4. 0 and when i press on the version it send me to jshigetomi's github.

how can i know if it is ok or not? need your help please

3 Upvotes

64% Upvoted

13 comments sorted by

24

u/olavrb 12d ago edited 12d ago

Your antivirus software/driver updater suggesting a non-official source is more worrying.

When contributing to GitHub repos one often fork (create a copy of) the repo with your own user, do changes in your repo, then create a pull request / merge request back to the original repo.

The user you're asking about is an official maintainer, so nothing phishy there. But his fork is not the official PowerShell repo.

16

u/BlackV 12d ago

my antivirus software/drivers updater said I need to update my Powershel Core (x64) to 7.6.4. 0

Sounds like your antivirus is the problem here, rather than some random girhub repository
Is it full of AI garbage?

Only download from official source

1

u/Ok_Library163 12d ago

Thank you very much
I have Avast antivirus

9

u/Hel_OWeen 12d ago

Since Windows 10, you don't need a 3rd party AV scanner. Windows Defender does a decent job.

2

u/AdmRL_ 11d ago

Does it still do the awooga awooga when it detects stuff?

Old Avast Alarm (4.8 version)

1

u/BlackV 10d ago

how I hated that sound

3

u/God-is-my_Strength 11d ago

But the latest is 7.6.5. You can trust this releases here https://github.com/PowerShell/PowerShell

2

u/igrewupwithinternet 11d ago

Per Microsoft (and in my experience), the easiest way to install/maintain PS7 is using winget. The below may work, depending on how you installed originally.

winget update --id Microsoft.PowerShell --exact --source winget

If not, I'd recommend uninstalling any version of PS7 and then installing via winget - the below will install the latest release which is 7.6.5

winget install --id Microsoft.PowerShell --exact --source winget

You can always do winget show --id Microsoft.PowerShell --exact to view publisher URL, download URL, etc. to help verify the package is legit and from a trusted source.

Obviously don't just take my word for it, go look at Microsoft's official docs for installing PS7 to verify the package names I gave you are legit ;)

Your AV flagging an older version of PS7 isn't a false positive - some of the recent versions had several critical CVEs fixed in 7.6.4+. Doesn't mean you're infected, just vulnerable.

1

u/BlackV 11d ago edited 10d ago

You need an additional parameter now to get the MSI install, I dontt see that in your code example

1

u/igrewupwithinternet 4d ago

Indeed, I see that in their docs. But my questions are: why would one want the MSI installer over the MSIX installer, and what relevance does the install method have to OP's post/questions?

First question is purely born of my ignorance. I'm not aware of any use case beyond maybe legacy and if we're talking security, why are we talking legacy support? The same doc says they're dropping MSI support from version 7.7+.

2

u/BlackV 4d ago edited 4d ago

Msix does not support admin installs

Msix is a per user install

Msix is not installable on server (before 2022),mand in particular server core

Msix does not update through windows update (er.. if I am remembering that correctly)

Msix has issues running elevated

They had said they will drop it, but right there are a rather large number of breaking changes if they do drop msi, I think they'll delay that decision

There is a large thread on git hub about it (and I think here somewhere), I'll find the links

Edit: Current tagged issues for msix

https://github.com/PowerShell/PowerShell/issues?q=is%3Aissue%20state%3Aopen%20label%3APackage-MSIX

0

u/Over_Dingo 11d ago

this repo doesn't have releases, so even if it were malicious you would have hard time getting powershell from there anyway.
Also on main page it says "forked from <reponame>", which wouldn't be the case if someone wanted to obfuscate that they're not the official source

github has a handy url shortcut '/releases/latest/', so it's easy to memorize https://github.com/PowerShell/PowerShell/releases/latest, which will always give you the latest stable version