If you're not willing to pay, I seriously recommend the built in Windows Defender (assuming you are using win10/11). It's as good or better than every free alternative I've tried, and it comes with the OS - all you need to do to use it is nothing - just _don't_ install another AV.

This is my standard time to paste it: Most of the enterprise configuration options in Defender can be put in place on a standalone desktop by opening gpedit.msc. You can configure exclusion paths for node_modules. You can configure sensitivity ("cloud protection level"), you can configure "Block at first site", you can configure "Potentially unwanted software" detection. Which you may choose to disable, but is absolutely brilliant for family members downloading "questionable" software.

The Attack Surface Reduction rules can be put in place here even for people who disable realtime scans or use alternate AV products and provide significant, clear security benefits. The "block access to lsass.exe" option breaks mimikatz, procdump et al and is absolutely underrated for its capabilities. And free.

If you use Pro, that is... gpedit.msc is not available on Home editions...just to note.

You can use ConfigureDefender to set the windows defender settings -

https://github.com/AndyFul/ConfigureDefender

Note: you can scroll ConfigureDefender down to get to the exclusions interface ;O)

> You can configure exclusion paths for node_modules.

With all the viruses going 'round in node_modules these days, that might not be such a good idea.

Personally, node_modules may be the last thing that I exclude.

If it's too slow, consider using WSL2 for your NodeJS development.

Isn't Windows Defender one of the worst performing AVs?

Microsoft/Windows Defender used to perform poorly on tests, but not anymore. AV-Comparatives awarded Microsoft Defender its highest Advanced+ rating in its most recent malware protection and real-world protection tests:

https://www.av-comparatives.org/tests/malware-protection-tes...

https://www.av-comparatives.org/tests/real-world-protection-...

In terms of protection, sure, but for actual system performance, Defender is still hot garbage:

https://www.av-comparatives.org/tests/performance-test-octob...

When I wrote that comment I had performance in mind.

Windows defender is perfectly adequate these days, and it's already there so might as well make use of it.

I wonder what the monetization plan was, with no ads, no upsell, no spying.

I assumed it was because they were using us, the Free users, as warning canaries for any viruses that might impact their paying customers, with their heuristic detection algorithms.