PushWarden

Free · Linux, macOS, Windows

Stop PolinRider before it runs.

The PolinRider malware hides inside the projects you clone. PushWarden catches it the moment it lands on your computer, locks it away before it can run, and tells you exactly what it found.

Install PushWarden

Download Read the documentation

Choose your system below.

Free. No administrator password. It keeps itself up to date.

  • Free to useOne small program, nothing else to install
  • No administrator rightsInstalls and runs as your user
  • Signed updatesVerified with ed25519 and SHA-256 before install
  • Private by defaultNothing leaves the machine unless you opt in

The threat

It gets in through a project you trust

PolinRider is a campaign attributed to North Korean (DPRK, Lazarus) operators. It targets software developers, often through fake job interviews in which the victim is asked to clone and run a repository.

  1. It hides in ordinary project files

    Obfuscated loaders are appended to config files such as postcss.config.mjs, placed in files that pretend to be fonts, and started by .vscode/tasks.json tasks that run when a folder is opened.

  2. It runs when you open or build the project

    Opening the folder in the editor or starting the dev server is enough. Tokens, SSH keys, browser sessions and wallet files are collected and sent to command servers.

  3. It spreads through git

    With a stolen token it rewrites repositories and force-pushes the backdoor to every branch it can reach, so colleagues who pull become infected too.

  • 2,000+GitHub owners reached
  • 4,000+repositories hit
  • Mar to Sep 2026the period those figures cover

Protection

Install it once. It has your back.

PushWarden runs quietly in the background and watches your projects for you. Anything it removes you can put back, and it always tells you why it acted.

Always watching

A new file in your projects is checked within a second of being written. Running programs and network connections are checked every five seconds.

Real-time guard

Nothing is lost

A bad file is locked away before it can run, and you are shown what was found. Changed your mind? Put it back with one command.

Response and recovery

The attackers are cut off

Your computer is stopped from talking to the malware's servers, so nothing can be sent to them. The block stays after a restart.

Blocking C2 servers

Safe to open a project

VS Code and editors like it are set so that opening a folder cannot run anything on its own.

Hardening

Your GitHub, cleaned

The malware is removed from every branch of your repositories with one ordinary commit each. Your history is never rewritten.

Cleaning GitHub repositories

See everything it did

Every file it found and every step it took is written down with the reason, and you can look it up any time.

Activity history

Check whenever you like

Scan one folder or your whole computer whenever you want. A full check also runs by itself every six hours.

Scanning

Keeps it out of your team's code

Stops an infected commit before it is made, and fails the build if one slips into a pull request.

CI and automation

Stays up to date by itself

It learns about new variants every day and updates itself. Every update is verified before it is installed.

Updates

Guided screens

Clean your GitHub repositories with ease

No commands to remember. Open PushWarden and follow the screens.

  • No new sign-in: it uses the GitHub logins already on your computer.
  • Look before you fix: it shows you every infected branch and file first, and changes nothing.
  • You stay in charge: nothing is pushed until you say yes.
  • Take a break any time: stop whenever you like and carry on later where you left off.
See how it works

Install

Get PushWarden

One step, and only for your own user account. Coming from ThreatScan, the earlier name of this program? See moving to PushWarden.

Windows 10 and 11 your system

PushWarden-Setup.exe

The installer is not code-signed yet. If SmartScreen appears, choose More info, then Run anyway.

Afterwards, open PushWarden from the Start menu to check and clean your GitHub repositories on guided screens.

macOS 11 or later your system

Intel and Apple silicon. Open Terminal (Applications, Utilities, Terminal), paste this and press Return. No password needed:

curl -fsSL https://raw.githubusercontent.com/FaheemRafiq/pushwarden/main/installers/install.sh | sh

It downloads PushWarden, checks its SHA-256 against the published list, and sets it up for your user.

Prefer an installer? PushWarden.pkg

The package is not notarized yet, so macOS blocks it the first time ("unidentified developer"). Try to open it once, then go to System Settings, Privacy & Security, and click Open Anyway (it appears for about an hour). Or install it from Terminal: installer -pkg ~/Downloads/PushWarden.pkg -target CurrentUserHomeDirectory

Afterwards, open PushWarden from the Applications folder in your home folder to check and clean your GitHub repositories on guided screens.

Linux your system

Run in a terminal (no sudo):

curl -fsSL https://raw.githubusercontent.com/FaheemRafiq/pushwarden/main/installers/install.sh | sh

Or install a package (with sudo; it sets PushWarden up for your user):

Afterwards, pushwarden ui checks and cleans your GitHub repositories on guided screens.

After installing, check it any time with pushwarden status. Every download is listed with its SHA-256 in checksums.txt, which is signed.