polinrider-cleaner 2.3.0

Released 3 November 2026. No breaking changes.

New

• The folder and computer checks read weak.txt. Every text file up to 1 MB is searched for the review-level strings the CI scanner and the GitHub checks already used. A match is a review line, never a confirmed finding. Your own detection files, documentation and .vscode/ are set aside.
• Review-level file names. ioc/filenames-review.txt holds names a legitimate project can also have, such as spellright.dict, branch_structure.json, clr_init.vbs and solid Font Awesome fonts named for a weight Font Awesome does not ship. A match is a review line, in all three checks.
• The attacker’s SSH key. The computer check reads ~/.ssh/authorized_keys and names a line that carries a published attacker key, from the related MicrosoftSystem64 malware. It never edits the file: removing the line is yours to do.
• The JavaScript implant while it runs. A node process whose script sits in a folder the related MicrosoftSystem64 implant uses is confirmed as that implant running now.
• Known campaign files on GitHub. The GitHub check hashes tasks.json, font files and build configs on every branch, tag and commit, so restore, remove and erase handle a known file even when it holds no indicator string.
• Patterns in file contents. ioc/strong-patterns.txt holds confirmed indicators written as patterns, used by all three checks. The first matches node running a fa-solid-NNN.woff2 file. A config matched only by a pattern is confirmed, not stripped.
• 24 more indicators, from the Socket tracker review of 26 October and the 2 November review: 17 package names, a C2 address and six file hashes.

Changed

• A folder or computer that 2.2.0 called clean can now exit 1. That is the review-level strings and names above, each shown as a review line. Read them before acting: a review line is worth a look, not proof.
• The folder and computer checks show one more progress stage.
• Release pages on this site show the date of the release’s signed tag.

Breaking changes

None. Exit codes, commands and flags are as in 2.2.0.

Download

• macOS Apple siliconDownload .tar.gz
• macOS IntelDownload .tar.gz
• Linux x86_64Download .debDebian, UbuntuDownload .tar.gz
• Linux arm64Download .debDebian, UbuntuDownload .tar.gz
• Windows x86_64Download .zipDownload .tar.gz

SHA256SUMS · All files, the source archive and the provenance bundle on GitHub

Or use a package manager. Choose your system, then run only its commands:

brew install meSingh/tap/polinrider-scanner
polinrider

brew install meSingh/tap/polinrider-scanner
polinrider

scoop bucket add mesingh https://github.com/meSingh/scoop-bucket
scoop install polinrider-scanner
polinrider

Verify what you downloaded before you run it.