I am extremely worried, today on my server it issued several alerts about a lefthook.exe, coming from the discourse folders, in this warning it said that it was a malware "ML:Generic.MaliciousExe, how can I guarantee that this really is an authentic file and a fake positive, remembering that the server removed these files 4 times lefthook.exe, can anyone with more experience tell me if I should really accept the deletion or should I restore the files on the server?
AI-generated summary
A user named مباركمبارك reports receiving repeated antivirus alerts on their server flagging lefthook.exe — located within Discourse’s Docker/Yarn cache directories — as malware (“ML:Generic.MaliciousExe”). The file has been automatically deleted four times, and the user seeks confirmation whether this is a false positive or a real threat, asking whether to restore the file. maiki requests more details and screenshots to understand the context, noting the description lacks clarity about how the server is configured or how alerts are triggered. When مباركمبارك asks to continue privately due to sensitive alert content, maiki explains that public discussion is required for community support, advising private professional help if needed. In post 5, مباركمبارك shares the full file path: /tmp/.temp_mount_<MOUNT_ID>/var/lib/docker/overlay2/<LAYER_HASH>/diff/home/discourse/.cache/yarn/v6/npm-lefthook-windows-arm64-<VERSION>-<PACKAGE_HASH>-integrity/node_modules/lefthook-windows-arm64/bin, confirming the file is part of a Node.js package used by Discourse’s dependency chain. The concern centers on whether this legitimate development tool is being falsely flagged by antivirus software, and whether restoring it is safe.
Please share the full message text, along with screenshots of what you mean. It is not apparent from your description of how your server is run or how you are being sent “alerts”. 
Can I call you in private? Because there are some “messages” evident in these alerts, I may not be able to publish them for everyone.
Sorry that will not work: our community support is for discussing issues in public; if you are running into an issue with your server you will need to share enough for others to help you, or you should seek out someone who can help you privately.
The path where he claimed to have found malware was like this
/tmp/.temp_mount_<MOUNT_ID>/var/lib/docker/overlay2/<LAYER_HASH>/diff/home/discourse/.cache/yarn/v6/npm-lefthook- windows-arm64--<PACKAGE_HASH>-integrity/node_modules/lefthook-windows-arm64/bin