forkguard v0.3.1

Catch malware hidden in a repo before you install or run it.

forkguard checks a project for every trick used by the PolinRider malware campaign, the one that quietly rewrote commits in thousands of GitHub repos. It fails the build when it finds something dangerous and can open a pull request that removes it.

Use it

- uses: actions/checkout@v4
- uses: PRODHOSH/forkguard@v0.3.1
  with:
    open-pr: true

Leave out open-pr if you only want the build to fail.

New in this release

• Check a GitHub repo without cloning it. npx forkguard owner/repo checks every branch straight from GitHub, without writing the repo's files to your disk. Perfect for coding tests and repos you are about to fork.
• Check every repo you own. npx forkguard --mine checks all your GitHub repos, every branch, in one go.
• Rewritten commit detection on every branch, including old side branches where this malware likes to hide.
• Works in more terminals. Finds the GitHub CLI even in a terminal opened before it was installed.
• Full documentation: a beginner friendly getting started guide, a complete commands reference, a GitHub Action guide and a how it works page.

What it catches

• Code hidden after hundreds of spaces at the end of a normal line
• Scripts that secretly run node init before dev, build or start
• Fake font files that are really JavaScript, and the decoy folders around them
• VS Code tasks that run the moment you open the folder
• Known malicious npm packages
• An infected npm on the machine itself
• .env files that git is not ignoring, or that are committed
• A latest commit that was rewritten after it was made

Also a CLI

npx forkguard

Zero dependencies. MIT licensed. Docs: https://github.com/PRODHOSH/forkguard/blob/main/docs/getting-started.md

The full story is on my blog: https://blog.prodhosh.me/blog/malware-hid-in-my-old-repos-polinrider