Repository navigation
Releases
v3.0.0
What changed
The project is now polinrider-scanner. The repository is
meSingh/polinrider-scanner and the documentation is at
https://polinriderscanner.com. The program has not changed: it is still
polinrider, with the same options, output and exit codes, and it finds
exactly what 2.3.0 found.
Breaking changes
- Every package is renamed to polinrider-scanner.
- Homebrew: brew upgrade moves an existing polinrider-cleaner install to
the new name. - Scoop: run scoop uninstall polinrider-cleaner, then
scoop install polinrider-scanner. The old name stays at 2.3.0. - Debian and Ubuntu: installing the new .deb removes polinrider-cleaner.
- winget: the package will be meSingh.PolinRiderScanner. It is not in
the winget repository yet.
- Homebrew: brew upgrade moves an existing polinrider-cleaner install to
- Verify this and every later release with
gh attestation verify --repo meSingh/polinrider-scanner.
Releases before 3.0.0 were built under the old name and still verify
with --repo meSingh/polinrider-cleaner;
https://polinriderscanner.com/docs/reference/verifying-before-3/ has
every form, including one command that works for any version. - Links to the old repository keep working through GitHub's redirect, and
links to the old documentation address through redirect pages.
Also in 3.0.0
- A new website at https://polinriderscanner.com: a page that explains
PolinRider from the start, Updates with articles on the campaign, a
developer's guide to getting rid of it, the weekly indicator reviews, and
docs kept for each release line. - Release downloads are now counted daily on the public traffic branch,
with our own test downloads kept apart.
Download
One program, polinrider, with its indicator set in ioc/ beside it. Pick
the archive for your machine:
| Machine | Archive |
|---|---|
| macOS, Apple silicon | polinrider-v3.0.0-macos-arm64.tar.gz |
| macOS, Intel | polinrider-v3.0.0-macos-x86_64.tar.gz |
| Linux, x86_64 | polinrider-v3.0.0-linux-x86_64.tar.gz |
| Linux, arm64 | polinrider-v3.0.0-linux-arm64.tar.gz |
| Windows, x86_64 | polinrider-v3.0.0-windows-x86_64.zip or .tar.gz |
| Debian or Ubuntu, x86_64 | polinrider-v3.0.0-linux-x86_64.deb |
| Debian or Ubuntu, arm64 | polinrider-v3.0.0-linux-arm64.deb |
Unpack it and run polinrider with no arguments. It asks what to check, one
question at a time, and changes nothing until you type yes. The Windows zip
has polinrider.exe and ioc/ at its top level, so unpack it into a folder of
its own.
The .deb installs /usr/bin/polinrider with the indicators in
/usr/share/polinrider/ioc, where the binary looks for them:
sudo apt install ./polinrider-v3.0.0-linux-x86_64.debVerifying this release
Every archive and package here is checksummed and carries a build-provenance
attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS --ignore-missing
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-v3.0.0-macos-arm64.tar.gz \
--repo meSingh/polinrider-scanner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-v3.0.0-macos-arm64.tar.gz \
--bundle polinrider-v3.0.0.intoto.jsonl \
--repo meSingh/polinrider-scannerReleases before 3.0.0 were built when this repository was called
meSingh/polinrider-cleaner, and their attestations carry that name.
Verifying a release before 3.0.0 shows the command for them.
The tag itself is GPG-signed:
git tag -v v3.0.0On macOS the binary is not notarised, so the first run is stopped by
Gatekeeper. After verifying it as above:
xattr -d com.apple.quarantine ./polinriderWhat is in it
One binary, no runtime dependencies. The GitHub checks call git and gh,
which you need only for those. Every change is shown as a dry run first and
made only on a typed yes.
1.x, the shell tool, is still available from the
v1.0.9 release.
See the README to get
started, and AGENTS.md
if you are handing this to an AI agent.
v2.3.0
What changed
- The folder and computer checks read weak.txt. Every text file up to 1 MB
is searched for the review-level strings the CI scanner and the GitHub
checks already used. A match is a review line, never a confirmed finding. - Review-level file names (ioc/filenames-review.txt): names a legitimate
project can also have, such as spellright.dict, branch_structure.json and
clr_init.vbs. A match is a review line, in all three checks. - The computer check names a line in ~/.ssh/authorized_keys that carries a
published campaign key. It never edits the file. - A node process whose script sits in a folder the campaign uses is
confirmed as the JavaScript implant running now. - The GitHub check hashes tasks.json, font files and build configs on every
branch, tag and commit, so restore, remove and erase handle a known file
even when it holds no indicator string. - Confirmed indicators can be written as patterns (ioc/strong-patterns.txt),
used by all three checks. - 24 more indicators from the 26 October Socket review and the 2 November
review: 17 package names, a C2 address and six file hashes.
No breaking changes. Exit codes, commands and flags are as in 2.2.0. A
folder or computer that 2.2.0 called clean can now exit 1 on a review line.
Download
One program, polinrider, with its indicator set in ioc/ beside it. Pick
the archive for your machine:
| Machine | Archive |
|---|---|
| macOS, Apple silicon | polinrider-v2.3.0-macos-arm64.tar.gz |
| macOS, Intel | polinrider-v2.3.0-macos-x86_64.tar.gz |
| Linux, x86_64 | polinrider-v2.3.0-linux-x86_64.tar.gz |
| Linux, arm64 | polinrider-v2.3.0-linux-arm64.tar.gz |
| Windows, x86_64 | polinrider-v2.3.0-windows-x86_64.zip or .tar.gz |
| Debian or Ubuntu, x86_64 | polinrider-v2.3.0-linux-x86_64.deb |
| Debian or Ubuntu, arm64 | polinrider-v2.3.0-linux-arm64.deb |
Unpack it and run polinrider with no arguments. It asks what to check, one
question at a time, and changes nothing until you type yes. The Windows zip
has polinrider.exe and ioc/ at its top level, so unpack it into a folder of
its own.
The .deb installs /usr/bin/polinrider with the indicators in
/usr/share/polinrider/ioc, where the binary looks for them:
sudo apt install ./polinrider-v2.3.0-linux-x86_64.debVerifying this release
Every archive and package here is checksummed and carries a build-provenance
attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS --ignore-missing
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-v2.3.0-macos-arm64.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-v2.3.0-macos-arm64.tar.gz \
--bundle polinrider-v2.3.0.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v2.3.0On macOS the binary is not notarised, so the first run is stopped by
Gatekeeper. After verifying it as above:
xattr -d com.apple.quarantine ./polinriderWhat is in it
One binary, no runtime dependencies. The GitHub checks call git and gh,
which you need only for those. Every change is shown as a dry run first and
made only on a typed yes.
1.x, the shell tool, is still available from the
v1.0.9 release.
See the README to get
started, and AGENTS.md
if you are handing this to an AI agent.
v2.2.0
What changed
- The guided flow ends on where things stand. The last screen opens with
one sentence and a few lines of what the run did (checked, found, fixed,
confirmed on GitHub afterwards), then the list of what is still yours. - The next check is offered as a word: computer after GitHub, organization
or account after this computer or a folder, and done. done ends on a
short closing screen with where the list is saved. A later check never
takes back what an earlier one found: the exit code is the worse of both. - polinrider --purge-evidence deletes the copies of repositories the GitHub
checks kept, after a typed yes. It deletes only a folder that holds
nothing but polinrider's own copies and refuses anything else untouched.
The copies hold the pre-attack commits, so run it after every restore. - Small campaign files are matched by their hash: a .vscode/tasks.json,
font file or build config whose SHA-256 is a published campaign file is
confirmed, whatever it holds. Two published hashes are added. - The CI scanner matches what 2.1.0 matches: escape-coded loaders and whole
package names. Re-run ci/install-workflow.sh to update a vendored copy
from 2.1.0 or earlier. - 14 more indicators from the 19 and 21 October weekly reviews.
No breaking changes. Exit codes, commands and flags are as in 2.1.0.
Download
One program, polinrider, with its indicator set in ioc/ beside it. Pick
the archive for your machine:
| Machine | Archive |
|---|---|
| macOS, Apple silicon | polinrider-v2.2.0-macos-arm64.tar.gz |
| macOS, Intel | polinrider-v2.2.0-macos-x86_64.tar.gz |
| Linux, x86_64 | polinrider-v2.2.0-linux-x86_64.tar.gz |
| Linux, arm64 | polinrider-v2.2.0-linux-arm64.tar.gz |
| Windows, x86_64 | polinrider-v2.2.0-windows-x86_64.zip or .tar.gz |
| Debian or Ubuntu, x86_64 | polinrider-v2.2.0-linux-x86_64.deb |
| Debian or Ubuntu, arm64 | polinrider-v2.2.0-linux-arm64.deb |
Unpack it and run polinrider with no arguments. It asks what to check, one
question at a time, and changes nothing until you type yes. The Windows zip
has polinrider.exe and ioc/ at its top level, so unpack it into a folder of
its own.
The .deb installs /usr/bin/polinrider with the indicators in
/usr/share/polinrider/ioc, where the binary looks for them:
sudo apt install ./polinrider-v2.2.0-linux-x86_64.debVerifying this release
Every archive and package here is checksummed and carries a build-provenance
attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS --ignore-missing
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-v2.2.0-macos-arm64.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-v2.2.0-macos-arm64.tar.gz \
--bundle polinrider-v2.2.0.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v2.2.0On macOS the binary is not notarised, so the first run is stopped by
Gatekeeper. After verifying it as above:
xattr -d com.apple.quarantine ./polinriderWhat is in it
One binary, no runtime dependencies. The GitHub checks call git and gh,
which you need only for those. Every change is shown as a dry run first and
made only on a typed yes.
1.x, the shell tool, is still available from the
v1.0.9 release.
See the README to get
started, and AGENTS.md
if you are handing this to an AI agent.
v2.1.0
What changed
- Finds loaders written in escape codes. The 5 October review found that 18
of 35 confirmed infected repositories carry a loader spelled entirely in
\u escapes, which 2.0.0 reported as clean. Files are now also matched
decoded, locally and on GitHub. A payload found this way is reported but
not cut out of a build config, since it cannot be located byte for byte. - Checks two new places the campaign can persist: Python startup files
(.pth) in site-packages, and npm's own program files, plus the two
~/.npmrc settings that make npm run code. - Reads package names from package.json and the npm, yarn and pnpm
lockfiles and compares them whole. A campaign name inside a longer package
name, or in a description, is no longer reported. A manifest that cannot
be read is still matched as text, with a review line saying so. - 12 more indicators from the 12 October weekly review.
- New downloads: a Windows .zip and .deb packages for Debian and Ubuntu,
x86_64 and arm64. Homebrew and Scoop are updated by pull request after
each release.
Download
One program, polinrider, with its indicator set in ioc/ beside it. Pick
the archive for your machine:
| Machine | Archive |
|---|---|
| macOS, Apple silicon | polinrider-v2.1.0-macos-arm64.tar.gz |
| macOS, Intel | polinrider-v2.1.0-macos-x86_64.tar.gz |
| Linux, x86_64 | polinrider-v2.1.0-linux-x86_64.tar.gz |
| Linux, arm64 | polinrider-v2.1.0-linux-arm64.tar.gz |
| Windows, x86_64 | polinrider-v2.1.0-windows-x86_64.zip or .tar.gz |
| Debian or Ubuntu, x86_64 | polinrider-v2.1.0-linux-x86_64.deb |
| Debian or Ubuntu, arm64 | polinrider-v2.1.0-linux-arm64.deb |
Unpack it and run polinrider with no arguments. It asks what to check, one
question at a time, and changes nothing until you type yes. The Windows zip
has polinrider.exe and ioc/ at its top level, so unpack it into a folder of
its own.
The .deb installs /usr/bin/polinrider with the indicators in
/usr/share/polinrider/ioc, where the binary looks for them:
sudo apt install ./polinrider-v2.1.0-linux-x86_64.debVerifying this release
Every archive and package here is checksummed and carries a build-provenance
attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS --ignore-missing
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-v2.1.0-macos-arm64.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-v2.1.0-macos-arm64.tar.gz \
--bundle polinrider-v2.1.0.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v2.1.0On macOS the binary is not notarised, so the first run is stopped by
Gatekeeper. After verifying it as above:
xattr -d com.apple.quarantine ./polinriderWhat is in it
One binary, no runtime dependencies. The GitHub checks call git and gh,
which you need only for those. Every change is shown as a dry run first and
made only on a typed yes.
1.x, the shell tool, is still available from the
v1.0.9 release.
See the README to get
started, and AGENTS.md
if you are handing this to an AI agent.
v2.0.0
Download
One program, polinrider, with its indicator set in ioc/ beside it. Pick
the archive for your machine:
| Machine | Archive |
|---|---|
| macOS, Apple silicon | polinrider-v2.0.0-macos-arm64.tar.gz |
| macOS, Intel | polinrider-v2.0.0-macos-x86_64.tar.gz |
| Linux, x86_64 | polinrider-v2.0.0-linux-x86_64.tar.gz |
| Linux, arm64 | polinrider-v2.0.0-linux-arm64.tar.gz |
| Windows, x86_64 | polinrider-v2.0.0-windows-x86_64.tar.gz |
Unpack it and run polinrider with no arguments. It asks what to check, one
question at a time, and changes nothing until you type yes.
Verifying this release
Every archive here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS --ignore-missing
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-v2.0.0-macos-arm64.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-v2.0.0-macos-arm64.tar.gz \
--bundle polinrider-v2.0.0.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v2.0.0On macOS the binary is not notarised, so the first run is stopped by
Gatekeeper. After verifying it as above:
xattr -d com.apple.quarantine ./polinriderWhat is in it
One binary, no runtime dependencies. The GitHub checks call git and gh,
which you need only for those. Every change is shown as a dry run first and
made only on a typed yes.
1.x, the shell tool, is still available from the
v1.0.9 release.
See the README to get
started, and AGENTS.md
if you are handing this to an AI agent.
v1.0.9
Verifying this release
Every artifact here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-cleaner-v1.0.9.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-cleaner-v1.0.9.tar.gz \
--bundle polinrider-cleaner-v1.0.9.tar.gz.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v1.0.9What is in it
Shell and PowerShell only. No Node, no Python, nothing to install beyond git,
gh and jq. Every destructive step is a dry run first.
See the README to pick
the part you need, and AGENTS.md
if you are handing this to an AI agent.
v1.0.8
Verifying this release
Every artifact here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-cleaner-v1.0.8.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-cleaner-v1.0.8.tar.gz \
--bundle polinrider-cleaner-v1.0.8.tar.gz.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v1.0.8What is in it
Shell and PowerShell only. No Node, no Python, nothing to install beyond git,
gh and jq. Every destructive step is a dry run first.
See the README to pick
the part you need, and AGENTS.md
if you are handing this to an AI agent.
v1.0.7
Verifying this release
Every artifact here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-cleaner-v1.0.7.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-cleaner-v1.0.7.tar.gz \
--bundle polinrider-cleaner-v1.0.7.tar.gz.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v1.0.7What is in it
Shell and PowerShell only. No Node, no Python, nothing to install beyond git,
gh and jq. Every destructive step is a dry run first.
See the README to pick
the part you need, and AGENTS.md
if you are handing this to an AI agent.
v1.0.6
Verifying this release
Every artifact here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-cleaner-v1.0.6.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-cleaner-v1.0.6.tar.gz \
--bundle polinrider-cleaner-v1.0.6.tar.gz.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v1.0.6What is in it
Shell and PowerShell only. No Node, no Python, nothing to install beyond git,
gh and jq. Every destructive step is a dry run first.
See the README to pick
the part you need, and AGENTS.md
if you are handing this to an AI agent.
v1.0.5
Verifying this release
Every artifact here is checksummed and carries a build-provenance attestation.
Verify before you run any of it. This is a tool for recovering from tampered
code, so take it at its word about nothing.
# 1. the checksum matches
sha256sum -c SHA256SUMS
# 2. the archive really was built by this repository's CI, at this tag
gh attestation verify polinrider-cleaner-v1.0.5.tar.gz \
--repo meSingh/polinrider-cleaner
# ...or offline, against the bundle attached here, with no network call
gh attestation verify polinrider-cleaner-v1.0.5.tar.gz \
--bundle polinrider-cleaner-v1.0.5.tar.gz.intoto.jsonl \
--repo meSingh/polinrider-cleanerThe tag itself is GPG-signed:
git tag -v v1.0.5What is in it
Shell and PowerShell only. No Node, no Python, nothing to install beyond git,
gh and jq. Every destructive step is a dry run first.
See the README to pick
the part you need, and AGENTS.md
if you are handing this to an AI agent.