My antivirus or driver-updater program says I need to update PowerShell Core (x64) to version 7.6.4.0. However, clicking the version link takes me to a GitHub account owned by jshigetomi instead of an official Microsoft or PowerShell download page. Is that account legitimate, and what is the safest way to verify or install the update?
3 Answers
The updater itself is the bigger concern here. Security and driver utilities sometimes provide questionable or poorly verified update links. Check the publisher, download URL, and digital signature before installing anything. Do not install PowerShell from an unfamiliar repository just because an antivirus program recommends it.
You can install or update PowerShell through Microsoft's official package source with winget. Try `winget show --id Microsoft.PowerShell --exact` first to inspect the publisher and URLs, then use `winget update --id Microsoft.PowerShell --exact --source winget`. If it is not already installed through winget, use `winget install --id Microsoft.PowerShell --exact --source winget`. The current release may be newer than the one your updater listed, so check the official release page rather than trusting that alert alone.
The account appears to be an official maintainer, so it is not necessarily a scam. However, a personal fork or mirror is still not the same thing as the official PowerShell project. It is safer to download PowerShell from Microsoft's documentation or the official PowerShell repository rather than relying on a third-party updater's link.
Thanks for clarifying. The antivirus I use is Avast, so I will verify the source through Microsoft's official installation instructions instead.