polinrider-cleaner 2.2.0

Released 26 October 2026. No breaking changes.

New

• The guided flow ends on where things stand. The last screen now opens with one sentence (“GitHub is clean again.”, “Nothing found on this computer.”) and a few lines of what the run did: what was checked, found, fixed and confirmed on GitHub afterwards. Then the list of what is still yours to do.
• The next check is offered as a word. After GitHub, type computer to check this computer in the same session; after this computer or a folder, organization or account. Type done to finish, and the session ends on a short closing screen with where the list is saved. A later check never takes back what an earlier one found: the exit code is the worse of the two.
• polinrider --purge-evidence deletes the copies of repositories the GitHub checks kept, after you type yes. Add --evidence DIR if you chose the folder. It deletes only a folder that holds nothing but polinrider’s own copies, and refuses anything else without touching it. The copies are the only copy of the commits from before the attack, so run it after every restore is done.
• Small campaign files are matched by their hash. A .vscode/tasks.json, font file or build config whose SHA-256 is a published campaign file is confirmed, whatever it holds. Two published hashes are added: the tasks.json that runs a fake font on folder open, and the fake font.
• 14 more indicators, from the 19 October and 21 October reviews.

Changed

• The CI scanner matches what 2.1.0 matches: loaders written in escape codes, and package names read from manifests and compared whole. If you vendored ci/scan-workspace.sh into a repository from 2.1.0 or earlier, run ci/install-workflow.sh again to update it.
• The winget manifests are written against schema 1.12.

Breaking changes

None. Exit codes, commands and flags are as in 2.1.0. --purge-evidence is new, and the guided flow asks one more question at the end, which done or q answers.

Download

• macOS Apple siliconDownload .tar.gz
• macOS IntelDownload .tar.gz
• Linux x86_64Download .debDebian, UbuntuDownload .tar.gz
• Linux arm64Download .debDebian, UbuntuDownload .tar.gz
• Windows x86_64Download .zipDownload .tar.gz

SHA256SUMS · All files, the source archive and the provenance bundle on GitHub

Or use a package manager. Choose your system, then run only its commands:

brew install meSingh/tap/polinrider-scanner
polinrider

brew install meSingh/tap/polinrider-scanner
polinrider

scoop bucket add mesingh https://github.com/meSingh/scoop-bucket
scoop install polinrider-scanner
polinrider

Verify what you downloaded before you run it.