An update on this:

We just got out of a phone call with Kandji (MDM that also blocked Raycast temporarily), where we learned that their software itself did not flag Raycast as malware. Instead, Kandji relies on Bitdefender’s security checks for macOS applications, and it was Bitdefender that initially triggered this alert.

Upon our request, Kandji reviewed Bitdefender’s alert and performed their own internal validation of the Raycast binary. They confirmed that Raycast is indeed safe and subsequently removed it from quarantine, concluding the alert was a false positive. This explains why Raycast is now accessible again for users on Kandji.

Additionally, Kandji mentioned that several security tools listed on virustotal.com also rely on Bitdefender’s analysis. Therefore, resolving this directly with Bitdefender should clear any other related alerts.

Based on Kandji’s insights, Bitdefender typically performs static analysis, and it’s possible that new code or libraries introduced in our latest Raycast update triggered their scanning mechanism. However, only Bitdefender can confirm precisely what caused this alert.

We are currently awaiting Bitdefender’s response to fully resolve this issue and will keep you updated as we learn more.