PolinRider Scanner

    Download

    Announcement

    PolinRider Scanner 3.0: polinrider-cleaner has a new name and a new home

    · 4 min read

    polinrider-cleaner is now PolinRider Scanner and Cleaner. The program itself has not changed: it is still polinrider, with the same options, the same output and the same exit codes. What changes is where it lives, what the packages are called and how you check that a download is genuine. That is why this release is 3.0.0 rather than 2.4.

    Where everything is now

    Bookmark these, and check any link you are sent against them.

    What Address
    Website polinriderscanner.com
    Source code github.com/meSingh/polinrider-scanner
    Downloads github.com/meSingh/polinrider-scanner/releases
    Homebrew tap github.com/meSingh/homebrew-tap
    Scoop bucket github.com/meSingh/scoop-bucket

    The old addresses still work. GitHub redirects github.com/meSingh/polinrider-cleaner to the new repository, for the web, for git and for the API, and links to the site’s old GitHub Pages address send you here.

    Upgrade from 2.x

    Pick the way you installed it.

    Homebrew (macOS and Linux)

    brew upgrade moves an existing polinrider-cleaner install to the new name by itself:

    brew update
brew upgrade

    Scoop (Windows)

    Scoop does not move you across. Remove the old package and install the new one:

    scoop uninstall polinrider-cleaner
scoop update
scoop install polinrider-scanner

    The old name stays at 2.3.0 and scoop status reports it as deprecated.

    Debian and Ubuntu

    Download the new .deb, check it and install it. Installing it removes the old polinrider-cleaner package. On ARM, use linux-arm64 in place of linux-x86_64.

    gh release download v3.0.0 --repo meSingh/polinrider-scanner --pattern 'polinrider-v3.0.0-linux-x86_64.deb'
gh attestation verify polinrider-v3.0.0-linux-x86_64.deb --repo meSingh/polinrider-scanner
sudo apt install ./polinrider-v3.0.0-linux-x86_64.deb

    A downloaded archive

    Download the archive for your system from the releases page, check it as shown below and replace your old folder with the new one. Keep the ioc/ folder beside the binary.

    winget

    A winget package is being prepared as meSingh.PolinRiderScanner. It is not in the winget repository yet.

    The CI scanner in your repositories

    Nothing to do. The ioc/ folder has the same layout, and the scan you vendored never named the repository.

    Check the upgrade

    polinrider --version

    The version it shows should be 3.0.0.

    New to it? Install 3.0

    brew install meSingh/tap/polinrider-scanner
    scoop bucket add mesingh https://github.com/meSingh/scoop-bucket
scoop install polinrider-scanner

    Every other way to install it is in the README.

    Check that a download is genuine

    Every release from 3.0.0 on is checked against the new name:

    gh attestation verify polinrider-v3.0.0-macos-arm64.tar.gz --repo meSingh/polinrider-scanner

    Releases up to 2.3.0 were attested while the repository was still called polinrider-cleaner, and their attestations record that name. The new name fails for them, with an error that looks like a fake file but is not one. Use the old name, which GitHub still follows:

    gh attestation verify polinrider-v2.3.0-macos-arm64.tar.gz --repo meSingh/polinrider-cleaner

    Or use one command that works for a release of any version, and also proves the file was built by this repository’s release workflow:

    gh attestation verify polinrider-v2.3.0-macos-arm64.tar.gz \
  --owner meSingh \
  --cert-identity-regex '^https://github\.com/meSingh/polinrider-(cleaner|scanner)/\.github/workflows/release\.yml@refs/tags/v'

    We tested every form on the day of the rename. Verifying releases from before 3.0 has the rest, including how to confirm the attestation came from this repository and not a later holder of the old name.

    What else is new

    The documentation site has been rebuilt. Updates, where this post lives, carries news on the campaign and our own guides and analysis. It also points to articles by other researchers that are worth your time. Every weekly indicator review is still public. A new page, What is PolinRider?, explains the malware from the start for a developer who has never heard of it: how it gets in, what it takes, why your Git history looks clean and the signs to look for. The docs are now kept for each release line, so someone running an older version can still read instructions for the program they actually have.

    There is also a cleanup checklist and a longer guide to getting rid of PolinRider, written from what we learned cleaning up our own account and from what researchers have published since OpenSourceMalware’s August guide.

    The repository itself now keeps a daily record of release downloads on its public traffic branch. GitHub keeps only a running total per file, so until now there was no way to tell whether anyone came after a release or a post. Our own test downloads are recorded and taken off, so the weekly figure leaves our own out.

    What has not changed

    3.0.0 adds no new detection. It finds exactly what 2.3.0 found, and a clean result still means that today’s known signs are absent, not that nothing was ever there. The indicators are still checked against published reports every week.

    The other limits are the same too. The macOS binaries are not notarised, so Gatekeeper stops the first run until you clear the quarantine flag on a binary you have verified. Restoring a branch on GitHub still depends on GitHub serving the commit from before the attack, which it does only until it clears out unreferenced data, so check early. And it is still one person’s open source project, with no warranty and no support commitment.

    If you are here because something is wrong on your machine, start with the cleanup checklist.

    Sources