Under attack by PolinRider?
Find the malware and remove it safely.

How it works

1. 1

   Install it

   Choose your system. Run only its commands.

   macOS

   brew install meSingh/tap/polinrider-scanner

   Linux

   brew install meSingh/tap/polinrider-scanner

   On Debian or Ubuntu you can use the .deb from the latest release instead.

   Windows

   scoop bucket add mesingh https://github.com/meSingh/scoop-bucket
   scoop install polinrider-scanner

2. 2

   Run it and say what to check

   polinrider

   It asks What should I check? Type computer, or account or organization for GitHub. Answers are words, never numbers.

3. 3

   It scans. Nothing changes.

   It only reads, and shows each check as it runs. A GitHub check copies every repository first, so the evidence is kept before anything is touched.

4. 4

   You get one of three answers

   Clean

   None of today's signs found. Not proof it was never there: if you had a reason to check, change your passwords and tokens anyway.

   Review

   Something a normal project can also have. Read each [review] line and ask: did I put this here? If not, treat it as found.

   Compromised

   Something only the malware leaves. It lists what it found and the exact command for each next step. Go to step 5.

   If it says it could not run, it tells you why, and it found nothing either way. Is it PolinRider or a false alarm?

5. 5

   If it is compromised, these are your choices, in this order

   The order is fixed. If you clean GitHub while an infected computer still holds a valid token, the malware pushes itself back within minutes. Why

   This computer

   Type yes and every confirmed file moves into a quarantine folder, with a list of how to put each one back. Nothing is deleted. A startup entry, a crontab line or a shell startup file is never changed for you: it prints the command that removes it.

   If it says This machine cannot be trusted until it is rebuilt, quarantine contains it but only a clean reinstall makes it safe. Checking a computer

   Your passwords and tokens

   Change every one, from a different computer you trust: GitHub tokens and SSH keys, npm and cloud tokens, and the passwords saved in your browser.

   Your repositories

   First, every repository is copied into an evidence folder. Then each infected repository gets one of these five. When restore is offered, pick it.

   Fix	What it does	History rewritten?	Can you undo it?	When to pick it
   Restoretype restoreRecommended	Puts each branch back where GitHub's own push record says it was before the attack. Nothing is edited.	No. Each branch moves back to an earlier commit.	A copy from before is kept.	Whenever it is offered: GitHub's record shows a clean state, and that commit is checked clean first.
   Removetype remove	Adds one commit per branch that takes the malware out.	No. The malware stays in older commits.	Easy: it is one commit.	There is no clean state to go back to, and the history must stay as it is.
   Erasetype eraseRewrites history	Takes the malware out of every commit and pushes the history back.	Yes. Every commit ID changes, and every existing copy must be updated; it shows how.	A copy from before is kept.	There is no clean state to go back to, and the malware must be in no commit at all.
   Archivetype archive	Puts a large infected notice at the top of the README, rewrites the description and makes the repository read-only.	No. Nothing is removed.	A copy from before is kept.	A repository nobody uses.
   Skiptype skip	Leaves it as it is for now.	No.	Nothing changed.	You want to decide later.

   Each fix shows exactly what would change on GitHub and pushes only after you type yes. Afterwards, delete every local copy and clone it again. A GitHub account · An organisation

   Every future push

   Add the scanner to your CI, so a reinfection is caught on the next push. Every future push

   Read the developer's guide to getting rid of PolinRider