Vega SDK 0.24.9914 KeplerPerfCLI _path.so quarantined by VirusBarrier as

Vega Open Beta Q&A
1

Hello Amazon Vega Developer Support,

I am setting up Vega Developer Tools for a Fire TV Stick 4K Select and the installation is paused due to an antivirus quarantine.

Environment

  • Host: Mac Apple Silicon
  • Vega CLI: 1.3.4
  • Vega SDK: 0.24.9914
  • Device: Fire TV Stick 4K Select
  • Device OS: Vega OS 1.2
  • SDK/device alignment: SDK 0.24 for Vega OS 1.2

Issue
VirusBarrier quarantined the following file during/after SDK installation:

Package: KeplerPerfCLI-2.0.345.0
File: _path.so

Path:
/Users/intteinolo/vega/sdk/vega-sdk/main/0.24.9914/packages/KeplerPerfCLI/KeplerPerfCLI-2.0.345.0/AL2_x86_64/DEV.STD.PTHREAD/build/aarch64-Darwin/lib/matplotlib/_path.so

Detection: OSX/Amos.ext

Observed file metadata:

  • Type: Mach-O 64-bit bundle arm64
  • Size: 193456 bytes

The installation came from the official Vega SDK Manager / Amazon Vega Developer Tools flow. The file is currently quarantined and inaccessible. It has not been manually executed, restored, trusted, patched, or excluded.

Could you please confirm:

  1. Whether this _path.so binary is expected in KeplerPerfCLI-2.0.345.0 for Vega SDK 0.24.9914 on Apple Silicon.
  2. The expected SHA-256/checksum for this file or for the parent SDK archive/package.
  3. Whether KeplerPerfCLI ships a matplotlib native extension at this path.
  4. Whether there is an official safe recovery/reinstall procedure after antivirus quarantine.
  5. Whether Vega SDK/VDT supports an official minimal install that excludes KeplerPerfCLI/performance tooling.

I have kept the file quarantined and have paused Vega setup pending verification.

No full device serial/DSN is included in this report.

Thank you.

4

Hi @Carlos_Eduardo_Rodriguez_Lopez,

Thanks for the detailed report and for pausing rather than deleting the file. This is a false positive - _path.so is a legitimate SDK component.

Answering your questions:

1 & 3. Is this file expected, and does KeplerPerfCLI ship a matplotlib native extension here?

Yes to both. I confirmed against a clean 0.24.9914 install: the file exists at the exact path you listed, is a Mach-O 64-bit bundle arm64, and is 193456 bytes - matching your reported metadata exactly. It’s matplotlib’s native C extension (matplotlib/_path.so); KeplerPerfCLI bundles matplotlib to render performance charts. Its sibling extensions are in the same folder (_image.so, _qhull.so, ft2font.so, _tri.so). The same file ships in KeplerPerfCLI across earlier SDKs (0.21/0.22/0.23) as well.

2. Checksum.

The most reliable way to confirm you have a genuine, unmodified file is to reinstall the SDK version through the SDK Manager (steps in #4) - that pulls a fresh copy directly from the official flow, so you can trust the installed file without needing to match a standalone hash. Restoring from VirusBarrier’s quarantine should also return the original, but a clean reinstall is the surest way to verify integrity. If you specifically need a published checksum to satisfy a security process, let me know and I’ll check what’s available.

4. Safe recovery after quarantine.

Restore the file from VirusBarrier’s quarantine and add an exclusion for the SDK directory (~/vega/sdk/) so it isn’t re-quarantined. If restore isn’t clean, use the SDK Manager to repair/reinstall:

  • vega sdk config doctor - diagnose a damaged/incomplete install
  • vega sdk uninstall then vega sdk install - reinstall

Docs: SDK Manager Issues - Amazon Vega Docs

5. Minimal install excluding performance tooling.

The Vega SDK CLI manages SDKs at the version level (vega sdk supports install/uninstall/use per SDK version) and doesn’t expose a per-component option to exclude KeplerPerfCLI. The antivirus exclusion in (4) is the recommended way to proceed.

From Amazon’s side, the file is a legitimate SDK component (verified above), so the detection is a false positive rather than actual malware - you’re safe to restore it and continue setup. How to restore from quarantine or add a scan exclusion is specific to VirusBarrier, so for those exact steps we’d recommend Intego’s VirusBarrier documentation or support. You can also report the file to Intego as a false positive so they can update their detection.

Thanks for helping us improve the Vega platform.

Best regards,
Aishwarya

5

Hello Amazon Vega Developer Support,

I am setting up Vega Developer Tools for a Fire TV Stick 4K Select and the installation is paused due to an antivirus quarantine.

Environment:

  • Host: Mac Apple Silicon
  • Vega CLI: 1.3.4
  • Vega SDK: 0.24.9914
  • Device: Fire TV Stick 4K Select
  • Device OS: Vega OS 1.2
  • SDK/device alignment: SDK 0.24 for Vega OS 1.2

Issue:
VirusBarrier quarantined the following file during/after SDK installation:

Package:
KeplerPerfCLI-2.0.345.0

File:
_path.so

Path:
/Users/intteinolo/vega/sdk/vega-sdk/main/0.24.9914/packages/KeplerPerfCLI/KeplerPerfCLI-2.0.345.0/AL2_x86_64/DEV.STD.PTHREAD/build/aarch64-Darwin/lib/matplotlib/_path.so

Detection:
OSX/Amos.ext

Observed file metadata before deeper reads were blocked:

  • Type: Mach-O 64-bit bundle arm64
  • Size: 193456 bytes

The installation came from the official Vega SDK Manager / Amazon Vega Developer Tools flow. The file is now inaccessible due to quarantine. It has not been manually executed, restored, trusted, patched, or excluded.

Could you please confirm:

  1. Whether this _path.so binary is expected in KeplerPerfCLI-2.0.345.0 for Vega SDK 0.24.9914 on Apple Silicon.
  2. The expected SHA-256/checksum for this file or for the parent SDK archive/package.
  3. Whether KeplerPerfCLI ships a known matplotlib native extension at this path.
  4. Whether there is an official safe recovery/reinstall procedure after antivirus quarantine.
  5. Whether Vega SDK/VDT supports an official minimal install that excludes KeplerPerfCLI/performance tooling.

No full device serial/DSN is included here.

6

Hi @Carlos_Eduardo_Rodriguez_Lopez,

Thanks for the detailed report and for pausing rather than deleting the file. This is a false positive - _path.so is a legitimate SDK component.

Answering your questions:

1 & 3. Is this file expected, and does KeplerPerfCLI ship a matplotlib native extension here?

Yes to both. I confirmed against a clean 0.24.9914 install: the file exists at the exact path you listed, is a Mach-O 64-bit bundle arm64, and is 193456 bytes - matching your reported metadata exactly. It’s matplotlib’s native C extension (matplotlib/_path.so); KeplerPerfCLI bundles matplotlib to render performance charts. Its sibling extensions are in the same folder (_image.so, _qhull.so, ft2font.so, _tri.so). The same file ships in KeplerPerfCLI across earlier SDKs (0.21/0.22/0.23) as well.

2. Checksum.

The most reliable way to confirm you have a genuine, unmodified file is to reinstall the SDK version through the SDK Manager (steps in #4) - that pulls a fresh copy directly from the official flow, so you can trust the installed file without needing to match a standalone hash. Restoring from VirusBarrier’s quarantine should also return the original, but a clean reinstall is the surest way to verify integrity. If you specifically need a published checksum to satisfy a security process, let me know and I’ll check what’s available.

4. Safe recovery after quarantine.

Restore the file from VirusBarrier’s quarantine and add an exclusion for the SDK directory (~/vega/sdk/) so it isn’t re-quarantined. If restore isn’t clean, use the SDK Manager to repair/reinstall:

  • vega sdk config doctor - diagnose a damaged/incomplete install
  • vega sdk uninstall then vega sdk install - reinstall

Docs: SDK Manager Issues - Amazon Vega Docs

5. Minimal install excluding performance tooling.

The Vega SDK CLI manages SDKs at the version level (vega sdk supports install/uninstall/use per SDK version) and doesn’t expose a per-component option to exclude KeplerPerfCLI. The antivirus exclusion in (4) is the recommended way to proceed.

From Amazon’s side, the file is a legitimate SDK component (verified above), so the detection is a false positive rather than actual malware - you’re safe to restore it and continue setup. How to restore from quarantine or add a scan exclusion is specific to VirusBarrier, so for those exact steps we’d recommend Intego’s VirusBarrier documentation or support. You can also report the file to Intego as a false positive so they can update their detection.

Thanks for helping us improve the Vega platform.

Best regards,
Aishwarya