PushWarden

Free to start · Linux, macOS, Windows

Stop PolinRider before it runs.

The PolinRider malware hides inside the projects you clone. PushWarden catches it the moment it lands on your computer, locks it away before it can run, and tells you exactly what it found.

Install PushWarden

Download Read the documentation

Choose your system below.

Free to start. No administrator password. It keeps itself up to date.

  • Free to startOne small program, nothing else to install
  • No administrator rightsInstalls and runs as your user
  • Signed updatesVerified with ed25519 and SHA-256 before install
  • Private by defaultNothing leaves the machine unless you opt in

The threat

It gets in through a project you trust

PolinRider is a campaign attributed to North Korean (DPRK, Lazarus) operators. It targets software developers, often through fake job interviews in which the victim is asked to clone and run a repository.

  1. It hides in ordinary project files

    Obfuscated loaders are appended to config files such as postcss.config.mjs, placed in files that pretend to be fonts, and started by .vscode/tasks.json tasks that run when a folder is opened.

  2. It runs when you open or build the project

    Opening the folder in the editor or starting the dev server is enough. Tokens, SSH keys, browser sessions and wallet files are collected and sent to command servers.

  3. It spreads through git

    With a stolen token it rewrites repositories and force-pushes the backdoor to every branch it can reach, so colleagues who pull become infected too.

  • 2,000+GitHub owners reached
  • 4,000+repositories hit
  • Mar to Sep 2026the period those figures cover

The next campaign will use new names but the same tricks. PushWarden watches for the tricks too: projects that run code the moment you open them, install scripts and git hooks that download code, code hidden where your editor does not show it (even in invisible characters), and AI assistant settings or CI workflows that quietly run commands. What it catches

Protection

Install it once. It has your back.

PushWarden runs quietly in the background and watches your projects for you. Anything it removes you can put back, and it always tells you why it acted.

Always watching

A new file in your projects is checked within a second of being written. Running programs and network connections are checked every five seconds.

Real-time guard

Nothing is lost

A bad file is locked away before it can run, and you are shown what was found. Changed your mind? Put it back with one command.

Response and recovery

The attackers are cut off

Your computer is stopped from talking to the malware's servers, so nothing can be sent to them. The block stays after a restart.

Blocking C2 servers

Safe to open a project

VS Code and editors like it are set so that opening a folder cannot run anything on its own.

Hardening

Your GitHub, cleaned

See which branches of your repositories are infected, for free. With Pro, each one is fixed with one ordinary commit, and your history is never rewritten.

Cleaning GitHub repositories

See everything it did

Every file it found and every step it took is written down with the reason, and you can look it up any time.

Activity history

Check whenever you like

Scan one folder or your whole computer whenever you want. A full check also runs by itself every six hours.

Scanning

Keeps it out of your team's code

Stops an infected commit before it is made, and fails the build if one slips into a pull request.

CI and automation

Stays up to date by itself

It learns about new variants every day and updates itself. Every update is verified before it is installed.

Updates

Guided screens

Clean your GitHub repositories with ease

No commands to remember. Open PushWarden and follow the screens.

  • No new sign-in: it uses the GitHub logins already on your computer.
  • Look before you fix: it shows you every infected branch and file first, and changes nothing.
  • You stay in charge: nothing is pushed until you say yes.
  • Check for free: fixing and pushing comes with PushWarden Pro.
  • Take a break any time: stop whenever you like and carry on later where you left off.
See how it works

Free and Pro

Protection is free. Pro does the clean-up for you.

Both versions find the malware and stop it from running. Pro saves you the work that comes after.

Free

For everyone

  • Always watching your projects, programs and connections
  • Stops the malware: infected files are locked away before they can run
  • Cuts off the attackers and makes your editors safe
  • Checks your GitHub and shows every infected branch
Get PushWarden

Pro

Everything in Free, plus

  • Keeps your files: only the malicious part is removed, your own code stays where it is
  • Fixes your GitHub: every infected branch is cleaned and pushed for you, on screen or from the terminal
  • Unlocks in seconds: pushwarden activate with your key. Nothing is sent anywhere
About Pro

Install

Get PushWarden

One step, and only for your own user account. Coming from ThreatScan, the earlier name of this program? See moving to PushWarden. Installing on a server? There is a server install that starts at boot and needs no one at the screen.

Windows 10 and 11 your system

PushWarden-Setup.exe

The installer is not code-signed yet. If SmartScreen appears, choose More info, then Run anyway.

Afterwards, open PushWarden from the Start menu to check and clean your GitHub repositories on guided screens.

macOS 11 or later your system

Intel and Apple silicon. Open Terminal (Applications, Utilities, Terminal), paste this and press Return. No password needed:

curl -fsSL https://pushwarden.com/install.sh | sh

It downloads PushWarden, checks its SHA-256 against the published list, and sets it up for your user.

Prefer an installer? PushWarden.pkg

The package is not notarized yet, so macOS blocks it the first time ("unidentified developer"). Try to open it once, then go to System Settings, Privacy & Security, and click Open Anyway (it appears for about an hour). Or install it from Terminal: installer -pkg ~/Downloads/PushWarden.pkg -target CurrentUserHomeDirectory

Afterwards, open PushWarden from the Applications folder in your home folder to check and clean your GitHub repositories on guided screens.

Linux your system

Run in a terminal (no sudo):

curl -fsSL https://pushwarden.com/install.sh | sh

Or install a package (with sudo; it sets PushWarden up for your user):

Afterwards, pushwarden ui checks and cleans your GitHub repositories on guided screens.

After installing, check it any time with pushwarden status. Every download is listed with its SHA-256 in checksums.txt, which is signed.