Possible False Positive: IDP.HELU.PSE95 Blocking PowerShell During Cloudflare Wrangler Login

Viruses and worms
1

Hello Avast Support Team,

I would like to request a review of a possible false-positive detection involving Windows PowerShell.

Incident details:

  • Date: October 26, 2026

  • Detection: IDP.HELU.PSE95

  • Detection type: Command line detection

  • Avast component: Behavior Shield (Suspicious Actions Agent)

  • Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

  • Alert ID: d74bd727c523/2026-10-26T20:38:33.910Z

What happened:

I was using the official Cloudflare Wrangler CLI version 4.147.0 on Windows to authenticate to my Cloudflare account.

I executed the following command in PowerShell:

npx --yes wrangler@4.147.0 login --device

During the authentication process, Avast blocked PowerShell and displayed the IDP.HELU.PSE95 detection.

Afterward, I ran an Avast Smart Scan, which reported zero malware threats and zero system configuration issues.

I have not disabled Avast protection or added any exclusions.

I found a similar discussion about IDP.HELU.PSE94 involving PowerShell, where Avast later removed the detection. However, I understand that IDP.HELU.PSE95 is a different detection and requires its own review.

Could the Avast team please investigate whether this detection is legitimate or a false positive?

Since this is a behavioral command-line detection, please advise which diagnostic information would be appropriate to share without exposing authentication tokens or sensitive credentials.

Thank you for your assistance.

2

Hello @utilisateur7596 ,

The reported file was checked, and based on the findings, the detection was removed. The file is now marked as clean in the Avast database.

1 Like