Updated from version 2.8.1 to 2.9 Crowdstrike altert from IT

[eraldtroja]

I can provide more details as I get them from IT but in a nutshell this has occurred and I need some guidance.

I was at version 2.8.1 as of yesterday morning. I fired up the following commands to update my ports:

sudo port selfupdate
sudo port upgrade outdated
sudo port uninstall inactive

I'm running MacOS Sonoma 14.3. The system is managed by my IT department.

Within minutes of performing the update I received calls from IT stating that Crowdstrike had alerted them of a data dump, hence my machine would need to be brought in for a complete wipe.

I think this might be a case of a false positive, and I'll provide more details if needed, but I need to get some guidance of what an update from 2.8.1 to 2.9 does in order to possible categorize it as a false positive when it comes to a "data dump"

Thank you.

[jmroot (Joshua Root)]

Selfupdate involves downloading the latest tarballs of MacPorts base and the ports tree with rsync, then installing base if outdated, which is essentially just a typical ./configure && make && make install. I don't know what Crowdstrike considers a "data dump" so it's hard to say what might have triggered it. There was another ticket about Crowdstrike, where it didn't like the installer script examining and updating the macports unprivileged user account that we use for running builds: #66878