Cannot download fba - blocked by windows defender as trojan

[M.H]

I am trying to download a build from the studio (the .fba file) but it is blocked by Windows Defender as a trojan attack. Other clockfaces download just fine but Windows says this particular clockface is a "Trojan:JS/Foretype.A!ml" and "Alert level: Severe" with affected items:

• "containerfile: C:\Users\me\Downloads\myclock.fba"
• "file: C:\Users\me\Downloads\myclock.fba->device-gemini.zip->app/index.js"
• "file: C:\Users\me\Downloads\myclock.fba->device-higgs.zip->app/index.js"
• "file: C:\Users\me\Downloads\myclock.fba->device-meson.zip->app/index.js"
• "file: C:\Users\me\Downloads\myclock.fba->device-mira.zip->app/index.js"
• "webfile: C:\Users\me\Downloads\myclock.fba|about:internet|pid:16392,ProcessStart:132491915566839941"

Is there something actually wrong with the file or is this something I can safely ignore?

[Gondwana · Accepted solution]

Don't hold me responsible, but I'm guessing it's a false positive. Defender could be baulking on the .js files (which are executable, sort of), especially when they're doubly embedded within compressed archives (.fba and .zip) (which is a common way to try to hide executables from detection).

The file structure you posted is about what I'd expect in a .fba.

What's surprising is that nobody else seems to have reported this.

[M.H]

Thanks! I actually isolated it to a single line:

me.addEventListener("unload", saveSettings);

If I remove this or even replace it with onunload, Windows doesn't stop it from downloading. Super weird.

[Gondwana]

That was some fine detective work! It would explain why other people haven't mentioned this.