False positive "Android:Evo-gen [Trj]" on Huawei Optimizer

General
1

Hello,

My app “Origins Return” (package: com.uneetincelle.originsreturn) is being flagged as “Android:Evo-gen [Trj]” by the built-in virus scan on Huawei devices (Optimizer app, EMUI, which runs on the Avast SDK).

This is a closed beta test track on Google Play (not a public release), so only a small group of testers has access — but they’re seeing a “This app is infected” screen with an “Uninstall” prompt, which is causing real churn.

Important detail: this started specifically with the build following our Expo SDK 57 upgrade (React Native 0.86 / Hermes). Previous builds on Expo SDK 54, using the exact same source code base otherwise, were never flagged. Something in the new SDK/RN toolchain output apparently shifted the binary enough to trigger this heuristic.

I submitted this through the official false-positive form ( Report False Positive ) a week ago and haven’t received any response yet.

Why I believe this is a false positive:

  • The app is built with Expo/React Native, no malicious code, and hasn’t changed in behavior across this upgrade.

  • On a Google Pixel, Google Play Protect scans the exact same app/version with zero issues.

  • The detection only triggers on the Huawei/EMUI Avast-powered scanner — nothing else flags it.

App details:

  • App name: Origins Return

  • Package name: com.uneetincelle.originsreturn

  • Play Store link (closed beta): https://play.google.com/store/apps/details?id=com.uneetincelle.originsreturn

  • Detection name: Android:Evo-gen [Trj]

  • Where detected: Huawei Optimizer (EMUI built-in virus scan, Avast SDK)

  • Context: first appeared on the build right after upgrading from Expo SDK 54 to SDK 57 (React Native 0.86 / Hermes)

Could someone from the team help escalate this, or point me to the right place to get it reviewed? Happy to provide the APK/AAB directly if needed.

Thanks in advance.

2

This isn’t something I’m familiar with and given that the Avast Android App isn’t actually installed. I don’t know if the use of the Avast SDK in isolation is something that can be updated. Or if the virus database can be changed that the SDK would use.

However, I will try and draw some Avast Team input into this matter.

3

Hi @Matttt34 ,

Sorry for the delayed response. Our Threat Labs team downloaded an APK and an XAPK, but neither produced a detection in our database. Because this is a closed beta, they may not have been able to download the exact build that triggered the detection.

To investigate further, could you add the detected APK to a password-protected archive and send it to us?

Thank you, @DavidR, for highlighting this topic.

1 Like
4

Thanks @Zee123 and @DavidR, and no worries about the delay.

That explains why you couldn’t reproduce it: the build that triggers the detection is version 1.1.3 (versionCode 33), which is only in internal testing and not published on Google Play. The public version (1.1.2), and the APK/XAPK you downloaded, are different builds, and they are not flagged. The detection appeared with the build made after upgrading to Expo SDK 57 (React Native 0.86 / Hermes).

I exported the exact universal APK of that build (signed by Google) from the Play Console, put it in a password-protected zip, and submitted it through the Report False Positive form, mentioning this thread. I couldn’t find a way to send you a private message here, so if you need the file another way, please let me know which channel to use.

Thanks again for your help.

5

You’re welcome.

This may be a restriction in being a fairly new Community Member.

As far as being able to send a Private Message try this, in one of Zee123’posts, there is an Icon or just click on the user name next to it.

That will open profile information, from here you should see (if you have enough history/posts) Top Right Message, if you have permission.

In that Private Message you can upload a saved file from your system.

Edited - removed images..

6

Thanks @DavidR. I checked the profile and the Message button isn’t shown for me, probably because my account is too new. Could you or @Zee123 start a private message to me instead? I should be able to reply to it and upload the zip there.

7

Unfortunately not - the PMs outside of the Community Forum become too much to manage.

Zee, like myself should receive notifications about new posts in topics that they have posted in.