# PolinRider Scanner and Cleaner

> Check a machine, a GitHub account or a whole organization for PolinRider malware, and clean it up. Free and open source. Changes nothing until you say yes. MIT licensed, for macOS, Linux and Windows.

PolinRider is a supply-chain malware campaign that hides inside software projects, packages and editor extensions. Once it runs on a developer's computer it steals passwords and tokens, adds itself to the code they work on and pushes that code with their own account. Security researchers link it to North Korea. The threat page explains it with its sources.

The program is `polinrider`. Latest release: 3.0.0 (2026-11-04). Install with `brew install meSingh/tap/polinrider-scanner` (macOS, Linux) or Scoop on Windows, or download and verify a release. Run it with no arguments; it asks what to check (computer, folder, account, organization or everything).

Its answers and exit codes:
- 0 clean: None of the current indicators is present on what was checked. Not proof that nothing was ever there: rotate credentials anyway if you had a reason to check.
- 1 review: Nothing confirmed. Some lines name things a normal project can also have, or a check that could not run; a person has to decide.
- 2 compromised: At least one confirmed indicator: something only the malware leaves. Check the computer first, then GitHub.
- 3 could not run: The check could not run (a missing path, dependency, indicator set or GitHub login). It says nothing either way.

Content policy: Everything on this site is public. People, search engines, AI assistants and agents may read, quote and cite it; please link to the page you quote. The indicator set and the code are MIT licensed.

## Start here
- [The PolinRider threat](https://polinriderscanner.com/what-is-polinrider/): what it is, how it spreads, the signs, key facts with sources, questions people ask
- [Quick start](https://polinriderscanner.com/docs/quick-start/): install, verify and run the scanner
- [Is it PolinRider or a false alarm?](https://polinriderscanner.com/guides/polinrider-or-false-alarm/): how to read a result
- [Removing PolinRider: do it in this order](https://polinriderscanner.com/docs/guides/order/): why it comes back, and the order that stops it

## Docs: Install and run
- [Scan for PolinRider: quick start](https://polinriderscanner.com/docs/quick-start/): Download, verify and run one program that checks this computer, a folder, a GitHub account or an organization for PolinRider.
- [Verify polinrider before you run it](https://polinriderscanner.com/docs/reference/verifying/): How to check that polinrider came from this repository: signed commits, attested releases and SHA256SUMS on every release.
- [Verifying releases from before 3.0](https://polinriderscanner.com/docs/reference/verifying-before-3/): Releases up to 2.3.0 were built when the repository was called polinrider-cleaner. How to check one of them is genuine now that it is polinrider-scanner.

## Docs: Read the result
- [Exit codes](https://polinriderscanner.com/docs/reference/exit-codes/): What each polinrider exit code means for scripts and CI: 0 clean, 1 review, 2 compromised and 3 could not run, and what to do after each one.
- [PolinRider scanner false positives](https://polinriderscanner.com/docs/reference/false-positives/): Scanner matches that look alarming but are harmless, each one confirmed during a real PolinRider cleanup, why they match and what to do about them.

## Docs: Clean up, in this order
- [Removing PolinRider: do it in this order](https://polinriderscanner.com/docs/guides/order/): Why PolinRider comes back after a cleanup, and the order that stops it: machines, credentials, repositories, then every future push.
- [Remove PolinRider: the full cleanup checklist](https://polinriderscanner.com/docs/guides/getting-rid-of-polinrider/): Every step of a PolinRider cleanup on one checklist: infected computers, credentials, GitHub repositories and npm, and the checks still done by hand.
- [Check a computer for PolinRider](https://polinriderscanner.com/docs/guides/machine/): Check macOS, Linux or Windows for PolinRider with one read-only program, before you touch GitHub: infected files, persistence and an installed implant.
- [Check your GitHub account for PolinRider](https://polinriderscanner.com/docs/guides/account/): Check every branch and tag of every repository you own for PolinRider, see who pushed what from GitHub's push record, then restore or clean what was hit.
- [Scan a GitHub organization for PolinRider](https://polinriderscanner.com/docs/guides/organization/): Check every repository, branch and tag in a GitHub organization for PolinRider, see who pushed what, then restore or clean every repository that was hit.

## Docs: Keep it out
- [Block PolinRider in CI](https://polinriderscanner.com/docs/guides/ci/): A PolinRider scanner you copy into your own repository, so every push and pull request is checked in CI, with no third-party action to trust.

## Docs: The project
- [Contributing](https://polinriderscanner.com/docs/project/contributing/): How to report a missed PolinRider detection or a false positive, and how to propose a change to the scanner's code or to its indicator set.
- [Reporting a vulnerability](https://polinriderscanner.com/docs/project/security/): How to report a vulnerability in the PolinRider scanner privately through GitHub Security Advisories, and where to report an infection instead.
- [Disclaimer](https://polinriderscanner.com/docs/project/disclaimer/): Read before running: an independent open source project by one person, not a commercial product, and what that means for you.

## Updates
- [How to get rid of PolinRider: a developer's guide](https://polinriderscanner.com/guides/developers-guide-getting-rid-of-polinrider/): 2026-11-05. Think PolinRider is on your computer or in your repositories? How to check with polinrider, clean up in the right order and keep it from coming back.
- [PolinRider Scanner 3.0: polinrider-cleaner has a new name and a new home](https://polinriderscanner.com/announcements/polinrider-scanner-3-0/): 2026-11-04. The project is now polinrider-scanner, at polinriderscanner.com. The program is the same; the package names and how you verify old releases change.
- [MicrosoftSystem64: what it is and how to remove it](https://polinriderscanner.com/analysis/microsoftsystem64/): 2026-11-03. MicrosoftSystem64 is not part of Windows. It is a remote-access trojan that malicious npm packages install, now found inside working GitHub projects too.
- [Is it PolinRider or a false alarm? Reading a scan result](https://polinriderscanner.com/guides/polinrider-or-false-alarm/): 2026-11-03. polinrider 2.3.0 reads more of your files, so a project it once called clean can now show review lines. What each answer means and which matches are harmless.
- [Why PolinRider keeps coming back after you remove it](https://polinriderscanner.com/guides/polinrider-keeps-coming-back/): 2026-10-31. A developer's antivirus kept removing PolinRider and it kept returning. Their logs pointed to a logon entry. Where else it comes back from, and what stops it.
- [PolinRider's fake woff2 font that is really JavaScript](https://polinriderscanner.com/analysis/fake-woff2-font-javascript/): 2026-10-23. PolinRider hides its loader in files named like Font Awesome fonts, and it has gone by four names this year. The first four bytes give it away.
- [Found temp_auto_push.bat in your repository?](https://polinriderscanner.com/analysis/temp-auto-push-bat-polinrider/): 2026-10-18. temp_auto_push.bat is the script PolinRider uses to rewrite your commits and push them. What it does, why git log hides it and which computer to check first.
- [Weekly indicator reviews](https://polinriderscanner.com/indicator-reviews/): every review of the indicator set against published sources

## Indicators and releases
- [The indicator set](https://polinriderscanner.com/what-is-polinrider/indicators/): every indicator with its public source
- [ioc/strong.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/strong.txt): Text only the malware leaves (compromised)
- [ioc/strong-patterns.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/strong-patterns.txt): Patterns in file contents, where a part rotates (compromised)
- [ioc/bad-packages.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/bad-packages.txt): Malicious package names from the campaign (compromised)
- [ioc/filenames.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/filenames.txt): File names and paths that are signs on their own (compromised)
- [ioc/hashes.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/hashes.txt): SHA-256 hashes of known campaign files, whatever they are named (compromised)
- [ioc/ssh-keys.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/ssh-keys.txt): Attacker SSH keys added to authorized_keys (compromised)
- [ioc/network.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/network.txt): Campaign hosts and IP addresses, if a live connection matches (compromised)
- [ioc/implant-paths.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/implant-paths.txt): Paths of the related implant, if they exist (compromised)
- [ioc/implant-names.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/implant-names.txt): Implant program names, on an exact process-name match (compromised)
- [ioc/filenames-review.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/filenames-review.txt): File names a normal project can also have (review)
- [ioc/weak.txt](https://raw.githubusercontent.com/meSingh/polinrider-scanner/main/ioc/weak.txt): Text a normal project can also have (review)
- [Release 3.0.0](https://polinriderscanner.com/releases/v3.0.0/)
- [SHA256SUMS for the latest release](https://github.com/meSingh/polinrider-scanner/releases/download/v3.0.0/SHA256SUMS)
- [Verifying a download](https://polinriderscanner.com/docs/reference/verifying/)

## Machine-readable
- [polinrider.json](https://polinriderscanner.com/data/polinrider.json): latest release, downloads, checksums, verdicts, indicator files and key pages as JSON
- [llms-full.txt](https://polinriderscanner.com/llms-full.txt): the documentation, threat reference and updates in full, as Markdown
- [RSS](https://polinriderscanner.com/updates/rss.xml): updates and indicator reviews, full text

## Optional
- [About](https://polinriderscanner.com/about/): who maintains it and how releases and indicators are checked
- [Releases](https://polinriderscanner.com/releases/)
- [Source code](https://github.com/meSingh/polinrider-scanner)