{
  "schemaVersion": 1,
  "generated": "2026-11-05",
  "name": "PolinRider Scanner and Cleaner",
  "description": "Check a machine, a GitHub account or a whole organization for PolinRider malware, and clean it up. Free and open source. Changes nothing until you say yes.",
  "site": "https://polinriderscanner.com/",
  "repository": "https://github.com/meSingh/polinrider-scanner",
  "license": "MIT",
  "author": {
    "name": "Mandeep Singh",
    "url": "https://polinriderscanner.com/about/",
    "github": "https://github.com/meSingh"
  },
  "policy": "Everything on this site is public. People, search engines, AI assistants and agents may read, quote and cite it; please link to the page you quote. The indicator set and the code are MIT licensed.",
  "latestRelease": {
    "version": "3.0.0",
    "date": "2026-11-04",
    "notes": "https://polinriderscanner.com/releases/v3.0.0/",
    "github": "https://github.com/meSingh/polinrider-scanner/releases/tag/v3.0.0",
    "downloads": [
      {
        "system": "macOS, Apple silicon",
        "file": "polinrider-v3.0.0-macos-arm64.tar.gz",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-macos-arm64.tar.gz"
      },
      {
        "system": "macOS, Intel",
        "file": "polinrider-v3.0.0-macos-x86_64.tar.gz",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-macos-x86_64.tar.gz"
      },
      {
        "system": "Linux x86_64",
        "file": "polinrider-v3.0.0-linux-x86_64.tar.gz",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-linux-x86_64.tar.gz"
      },
      {
        "system": "Linux x86_64, Debian and Ubuntu",
        "file": "polinrider-v3.0.0-linux-x86_64.deb",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-linux-x86_64.deb"
      },
      {
        "system": "Linux arm64",
        "file": "polinrider-v3.0.0-linux-arm64.tar.gz",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-linux-arm64.tar.gz"
      },
      {
        "system": "Linux arm64, Debian and Ubuntu",
        "file": "polinrider-v3.0.0-linux-arm64.deb",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-linux-arm64.deb"
      },
      {
        "system": "Windows x86_64",
        "file": "polinrider-v3.0.0-windows-x86_64.zip",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-windows-x86_64.zip"
      },
      {
        "system": "Windows x86_64",
        "file": "polinrider-v3.0.0-windows-x86_64.tar.gz",
        "url": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0-windows-x86_64.tar.gz"
      }
    ],
    "checksums": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/SHA256SUMS",
    "attestation": "https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/polinrider-v3.0.0.intoto.jsonl",
    "verify": [
      "sha256sum -c SHA256SUMS --ignore-missing",
      "gh attestation verify polinrider-v3.0.0-macos-arm64.tar.gz --repo meSingh/polinrider-scanner"
    ],
    "verifyDocs": "https://polinriderscanner.com/docs/reference/verifying/"
  },
  "install": {
    "homebrew": "brew install meSingh/tap/polinrider-scanner",
    "scoop": "scoop bucket add mesingh https://github.com/meSingh/scoop-bucket\nscoop install polinrider-scanner",
    "run": "polinrider",
    "docs": "https://polinriderscanner.com/docs/quick-start/"
  },
  "verdicts": [
    {
      "exitCode": 0,
      "verdict": "clean",
      "meaning": "None of the current indicators is present on what was checked. Not proof that nothing was ever there: rotate credentials anyway if you had a reason to check."
    },
    {
      "exitCode": 1,
      "verdict": "review",
      "meaning": "Nothing confirmed. Some lines name things a normal project can also have, or a check that could not run; a person has to decide."
    },
    {
      "exitCode": 2,
      "verdict": "compromised",
      "meaning": "At least one confirmed indicator: something only the malware leaves. Check the computer first, then GitHub."
    },
    {
      "exitCode": 3,
      "verdict": "could not run",
      "meaning": "The check could not run (a missing path, dependency, indicator set or GitHub login). It says nothing either way."
    }
  ],
  "indicatorSet": {
    "folder": "https://github.com/meSingh/polinrider-scanner/tree/main/ioc",
    "page": "https://polinriderscanner.com/what-is-polinrider/indicators/",
    "lastReview": {
      "date": "2026-11-02",
      "url": "https://polinriderscanner.com/indicator-reviews/2026-11-02/"
    },
    "reviews": "https://polinriderscanner.com/indicator-reviews/",
    "files": [
      {
        "file": "strong.txt",
        "meaning": "Text only the malware leaves",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/strong.txt"
      },
      {
        "file": "strong-patterns.txt",
        "meaning": "Patterns in file contents, where a part rotates",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/strong-patterns.txt"
      },
      {
        "file": "bad-packages.txt",
        "meaning": "Malicious package names from the campaign",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/bad-packages.txt"
      },
      {
        "file": "filenames.txt",
        "meaning": "File names and paths that are signs on their own",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/filenames.txt"
      },
      {
        "file": "hashes.txt",
        "meaning": "SHA-256 hashes of known campaign files, whatever they are named",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/hashes.txt"
      },
      {
        "file": "ssh-keys.txt",
        "meaning": "Attacker SSH keys added to authorized_keys",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/ssh-keys.txt"
      },
      {
        "file": "network.txt",
        "meaning": "Campaign hosts and IP addresses, if a live connection matches",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/network.txt"
      },
      {
        "file": "implant-paths.txt",
        "meaning": "Paths of the related implant, if they exist",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/implant-paths.txt"
      },
      {
        "file": "implant-names.txt",
        "meaning": "Implant program names, on an exact process-name match",
        "effect": "compromised",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/implant-names.txt"
      },
      {
        "file": "filenames-review.txt",
        "meaning": "File names a normal project can also have",
        "effect": "review",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/filenames-review.txt"
      },
      {
        "file": "weak.txt",
        "meaning": "Text a normal project can also have",
        "effect": "review",
        "url": "https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/weak.txt"
      }
    ]
  },
  "pages": {
    "threat": {
      "title": "What is PolinRider malware?",
      "url": "https://polinriderscanner.com/what-is-polinrider/"
    },
    "about": {
      "title": "About",
      "url": "https://polinriderscanner.com/about/"
    },
    "docs": [
      {
        "group": "Install and run",
        "title": "Scan for PolinRider: quick start",
        "description": "Download, verify and run one program that checks this computer, a folder, a GitHub account or an organization for PolinRider.",
        "url": "https://polinriderscanner.com/docs/quick-start/"
      },
      {
        "group": "Install and run",
        "title": "Verify polinrider before you run it",
        "description": "How to check that polinrider came from this repository: signed commits, attested releases and SHA256SUMS on every release.",
        "url": "https://polinriderscanner.com/docs/reference/verifying/"
      },
      {
        "group": "Install and run",
        "title": "Verifying releases from before 3.0",
        "description": "Releases up to 2.3.0 were built when the repository was called polinrider-cleaner. How to check one of them is genuine now that it is polinrider-scanner.",
        "url": "https://polinriderscanner.com/docs/reference/verifying-before-3/"
      },
      {
        "group": "Read the result",
        "title": "Exit codes",
        "description": "What each polinrider exit code means for scripts and CI: 0 clean, 1 review, 2 compromised and 3 could not run, and what to do after each one.",
        "url": "https://polinriderscanner.com/docs/reference/exit-codes/"
      },
      {
        "group": "Read the result",
        "title": "PolinRider scanner false positives",
        "description": "Scanner matches that look alarming but are harmless, each one confirmed during a real PolinRider cleanup, why they match and what to do about them.",
        "url": "https://polinriderscanner.com/docs/reference/false-positives/"
      },
      {
        "group": "Clean up, in this order",
        "title": "Removing PolinRider: do it in this order",
        "description": "Why PolinRider comes back after a cleanup, and the order that stops it: machines, credentials, repositories, then every future push.",
        "url": "https://polinriderscanner.com/docs/guides/order/"
      },
      {
        "group": "Clean up, in this order",
        "title": "Remove PolinRider: the full cleanup checklist",
        "description": "Every step of a PolinRider cleanup on one checklist: infected computers, credentials, GitHub repositories and npm, and the checks still done by hand.",
        "url": "https://polinriderscanner.com/docs/guides/getting-rid-of-polinrider/"
      },
      {
        "group": "Clean up, in this order",
        "title": "Check a computer for PolinRider",
        "description": "Check macOS, Linux or Windows for PolinRider with one read-only program, before you touch GitHub: infected files, persistence and an installed implant.",
        "url": "https://polinriderscanner.com/docs/guides/machine/"
      },
      {
        "group": "Clean up, in this order",
        "title": "Check your GitHub account for PolinRider",
        "description": "Check every branch and tag of every repository you own for PolinRider, see who pushed what from GitHub's push record, then restore or clean what was hit.",
        "url": "https://polinriderscanner.com/docs/guides/account/"
      },
      {
        "group": "Clean up, in this order",
        "title": "Scan a GitHub organization for PolinRider",
        "description": "Check every repository, branch and tag in a GitHub organization for PolinRider, see who pushed what, then restore or clean every repository that was hit.",
        "url": "https://polinriderscanner.com/docs/guides/organization/"
      },
      {
        "group": "Keep it out",
        "title": "Block PolinRider in CI",
        "description": "A PolinRider scanner you copy into your own repository, so every push and pull request is checked in CI, with no third-party action to trust.",
        "url": "https://polinriderscanner.com/docs/guides/ci/"
      },
      {
        "group": "The project",
        "title": "Contributing",
        "description": "How to report a missed PolinRider detection or a false positive, and how to propose a change to the scanner's code or to its indicator set.",
        "url": "https://polinriderscanner.com/docs/project/contributing/"
      },
      {
        "group": "The project",
        "title": "Reporting a vulnerability",
        "description": "How to report a vulnerability in the PolinRider scanner privately through GitHub Security Advisories, and where to report an infection instead.",
        "url": "https://polinriderscanner.com/docs/project/security/"
      },
      {
        "group": "The project",
        "title": "Disclaimer",
        "description": "Read before running: an independent open source project by one person, not a commercial product, and what that means for you.",
        "url": "https://polinriderscanner.com/docs/project/disclaimer/"
      }
    ],
    "reference": [
      {
        "title": "PolinRider indicators of compromise",
        "description": "Every PolinRider indicator of compromise the scanner matches: file names, hashes, network addresses, SSH keys and packages, each with its public source.",
        "url": "https://polinriderscanner.com/what-is-polinrider/indicators/"
      }
    ],
    "updates": [
      {
        "title": "How to get rid of PolinRider: a developer's guide",
        "description": "Think PolinRider is on your computer or in your repositories? How to check with polinrider, clean up in the right order and keep it from coming back.",
        "date": "2026-11-05",
        "category": "guides",
        "url": "https://polinriderscanner.com/guides/developers-guide-getting-rid-of-polinrider/"
      },
      {
        "title": "PolinRider Scanner 3.0: polinrider-cleaner has a new name and a new home",
        "description": "The project is now polinrider-scanner, at polinriderscanner.com. The program is the same; the package names and how you verify old releases change.",
        "date": "2026-11-04",
        "category": "announcements",
        "url": "https://polinriderscanner.com/announcements/polinrider-scanner-3-0/"
      },
      {
        "title": "MicrosoftSystem64: what it is and how to remove it",
        "description": "MicrosoftSystem64 is not part of Windows. It is a remote-access trojan that malicious npm packages install, now found inside working GitHub projects too.",
        "date": "2026-11-03",
        "category": "analysis",
        "url": "https://polinriderscanner.com/analysis/microsoftsystem64/"
      },
      {
        "title": "Is it PolinRider or a false alarm? Reading a scan result",
        "description": "polinrider 2.3.0 reads more of your files, so a project it once called clean can now show review lines. What each answer means and which matches are harmless.",
        "date": "2026-11-03",
        "category": "guides",
        "url": "https://polinriderscanner.com/guides/polinrider-or-false-alarm/"
      },
      {
        "title": "Why PolinRider keeps coming back after you remove it",
        "description": "A developer's antivirus kept removing PolinRider and it kept returning. Their logs pointed to a logon entry. Where else it comes back from, and what stops it.",
        "date": "2026-10-31",
        "category": "guides",
        "url": "https://polinriderscanner.com/guides/polinrider-keeps-coming-back/"
      },
      {
        "title": "PolinRider's fake woff2 font that is really JavaScript",
        "description": "PolinRider hides its loader in files named like Font Awesome fonts, and it has gone by four names this year. The first four bytes give it away.",
        "date": "2026-10-23",
        "category": "analysis",
        "url": "https://polinriderscanner.com/analysis/fake-woff2-font-javascript/"
      },
      {
        "title": "Found temp_auto_push.bat in your repository?",
        "description": "temp_auto_push.bat is the script PolinRider uses to rewrite your commits and push them. What it does, why git log hides it and which computer to check first.",
        "date": "2026-10-18",
        "category": "analysis",
        "url": "https://polinriderscanner.com/analysis/temp-auto-push-bat-polinrider/"
      }
    ]
  },
  "feeds": {
    "rss": "https://polinriderscanner.com/updates/rss.xml",
    "sitemap": "https://polinriderscanner.com/sitemap-index.xml",
    "llms": "https://polinriderscanner.com/llms.txt",
    "llmsFull": "https://polinriderscanner.com/llms-full.txt"
  }
}