Free forever · No administrator rights · Pushes nothing anywhere [email protected]
PushWarden

Developer malware protection · Linux · macOS · Windows

Malware hides in the code you trust. PushWarden finds it, removes it and keeps it out.

Fake job-interview projects, poisoned packages and infected GitHub repositories are how attackers reach developers now. PushWarden scans your computer, stops the malware before it runs, and cleans every infected branch on your GitHub, in minutes.

Download free See GitHub clean

Choose your system below.

The real program, recorded: a scan of an infected interview project, then four GitHub repositories checked and cleaned. 47 seconds, no sound.
  • Free forever
  • No administrator rights
  • Pushes nothing anywhere
  • Everything it moves can be put back
Works with
  • Linux
  • macOS
  • Windows
  • GitHub
  • VS Code and Cursor
  • Claude Code and MCP configs
  • GitHub Actions
Active campaign

PolinRider reached 2,000+ GitHub owners and 4,000+ repositories between March and September 2026. It is attributed to DPRK (Lazarus) operators and spreads through ordinary projects. What PushWarden checks, and what it cannot see

Why you need it

Your antivirus does not read your repositories

Attackers stopped targeting programs and started targeting the files developers open every day. Most people only find out when a colleague, or GitHub, tells them.

You run code you did not write

Cloning a project, opening it in your editor and running npm install all run someone else's code. A fake recruiter's "coding test" only needs you to open the folder.

The payload looks like a normal file

It is appended to postcss.config.mjs, saved as a "font", hidden behind hundreds of spaces, or written in characters that draw nothing. Nothing looks wrong in your editor.

One stolen token infects your team

With your GitHub token the malware rewrites repositories and force-pushes itself to every branch it can reach. Colleagues who pull become the next victims.

Made for freelancers taking interview projects · maintainers · startups with a GitHub organisation · anyone who clones code from people they have never met.

How it stops the attack

It steps in at every stage, not just one

Most tools check one thing, once. PushWarden watches the whole path from clone to spread.

  1. 1 · Clone

    The infected project lands

    PushWarden: a new file is checked within a second of being written.

  2. 2 · Open

    The editor runs a hidden task

    PushWarden: flags the autorun task. With Pro, your editor is also set so a folder cannot run anything by itself.

  3. 3 · Steal

    Tokens and keys are sent out

    PushWarden: running programs are checked every five seconds. With Pro, the malware's servers are also blocked at the firewall.

  4. 4 · Spread

    Your repositories get infected

    PushWarden: finds every infected branch on GitHub and cleans each with one normal commit.

GitHub clean

Your whole GitHub, cleaned. Every branch.

PolinRider does not infect one repository. It infects all of them. PushWarden checks every repository you can push to, shows you what it found, and fixes each infected branch for you.

  • See everything first. A dry run lists each infected branch and file. It changes nothing.
  • One normal commit per branch. Your history is never rewritten and nothing is force-pushed, so teammates just pull.
  • Safe to stop. Take a break whenever you like and carry on where you left off.
  • No new sign-in. It uses the GitHub login already on your computer.
  • Commands or screens. pushwarden github-clean, or open the guided screens.
1 · Check (free)
2 · Fix and push (Pro)

Checking is free. Fixing and pushing comes with PushWarden Pro. How github-clean works · Guided screens. Output shown is from the real program on four demo repositories.

Built for servers too

If infected code reaches production, it does not get to run

PushWarden runs as a service on the servers that host your GitHub projects. Someone pushes a bad commit, a deploy copies it across, and this is what happens.

  1. 1
    Lands

    The file is written

    Checked within a second. Every script and config the deploy writes is read at once.

  2. 2
    Strong match

    You are told at once

    Alert with the steps. Free tells you what was found and how to remove it. With Pro it is quarantined for you, and only the malware is cut out of a config file.

  3. 3
    Running

    A running process is reported

    Alert. A process with a strict campaign marker is reported with how to stop it. With Pro it is killed for you and its servers are blocked.

  4. 4
    After

    You are told, and can undo

    Alert and history. A webhook and the log say why. With Pro, one command restores any file.

sudo pushwarden install --server starts it at boot with no one at the screen. Use --report-only if a person must approve every change. A pre-commit hook and a CI check stop the problem even earlier. What it can and cannot do, step by step · Server guide

Results

Tested on real code, not just claimed

These are numbers from our own checks on 15 October 2026. We say what they mean, and what they do not.

0high-severity false alarms in a deep scan of about 255,000 files across 24 real projects, node_modules included
412indicator entries built from 13 named public sources and our own rules, refreshed daily without a new release
7malware families covered: PolinRider, Shai-Hulud, GlassWorm, s1ngularity, Contagious Interview, Mini Shai-Hulud, git and CI droppers
200+automated tests, with an inert sample of each campaign and clean projects that must stay clean

What you can count on

  • Free only finds and tells you: it never changes your files. With Pro, files are moved to a quarantine, never deleted, and any can be put back with one command.
  • An offline defender: nothing is pushed anywhere, no telemetry, no cloud scan. It only downloads its own updates.
  • Updates are verified with ed25519 and SHA-256 before they are installed.

What it is not

  • Not a general antivirus. It looks for developer-targeted malware and complements your antivirus.
  • Not a package firewall. It cannot block a bad package before it arrives.
  • It can only know a campaign once its markers are published. Generic rules catch many new variants.

Every family, check by check, with sources · Security and privacy

Protection

Install it once. It has your back.

It runs quietly in the background. Anything it removes you can put back, and it always tells you why it acted.

Always watching

A new file is checked within a second of being written. Programs and network connections are checked every five seconds.

Real-time guard

Nothing is lost

A bad file is locked away before it can run, with the reason. Changed your mind? Put it back with one command.

Response and recovery

The attackers are cut off

With Pro, your computer is stopped from talking to the malware's servers, so nothing can be sent. The block stays after a restart.

Blocking C2 servers

Safe to open a project

With Pro, VS Code and similar editors are set so opening a folder cannot run anything on its own.

Hardening

Keeps it out of your team's code

With Pro, stops an infected commit before it is made, and fails the build if one slips into a pull request.

CI and automation

Runs on servers too

One command installs it as a system service that starts at boot, with no one at the screen.

Running on servers

Questions

Before you install

Is this an antivirus?

No. It is built for the malware that targets developers: infected projects, packages, editor tasks and repositories. Keep your antivirus too. See exactly what it covers and what it cannot see.

Does it send my code or file names anywhere?

No. There is no telemetry. It downloads updates and the indicator list, and with a Pro key it checks the licence about once a day. Alerts go to a webhook only if you set one. The full list is on the security page.

How do I get Pro, and how does the key reach me?

Pro is $19.99 a month for one device, and Team is $14.99 per seat a month for 2 to 50 devices, cheaper with more seats. Paying for a year costs less than twelve months. You pay the dollar price in USDT, on Solana or TRON. Buy on the checkout page: it shows the address and the amount to send (with a QR code), notices your payment by itself, and emails you the key within minutes. Then run pushwarden activate and paste it. When your month or year ends, pushwarden renew adds another to the same key. The checkout page shows a QR code and the amount.

Will it delete my files?

The free version never changes a file: it tells you what it found and how to remove it. Pro does it for you: it moves infected files to a quarantine (you can put any back) and removes only the malicious part of a config file. It never force-pushes or rewrites git history.

Does it need administrator rights?

No. It installs and runs as your user. With Pro, blocking the malware's servers at the firewall asks for administrator rights once, and you can skip that step.

What if it finds nothing?

Then it stays quiet. pushwarden status shows that every protection layer is on and when the last full check ran.

Find it. Remove it. Keep it out.

Install PushWarden in a minute. It is free to start, needs no administrator rights, and every file it moves can be put back.

Download free Read the quick start

Install

Get PushWarden

One step, and only for your own user account. Installing on a server? There is a server install that starts at boot and needs no one at the screen.

  1. Download the installer.

    PushWarden-Setup.exe

  2. Run it. No administrator password needed.

    The installer is not code-signed yet. If SmartScreen appears, choose More info, then Run anyway.

  3. Open PushWarden from the Start menu to check and clean your GitHub repositories on guided screens.
  1. Open Terminal (Applications, Utilities, Terminal), paste this and press Return. No password needed. 
    curl -fsSL https://pushwarden.com/install.sh | sh

    It downloads PushWarden, checks its SHA-256 against the published list, and sets it up for your user.

    Prefer an installer? Use the package

    PushWarden.pkg

    The package is not notarized yet, so macOS blocks it the first time. Try to open it once, then go to System Settings, Privacy & Security, and click Open Anyway (it appears for about an hour). Or install it from Terminal: installer -pkg ~/Downloads/PushWarden.pkg -target CurrentUserHomeDirectory

  2. Check it. pushwarden status should say PROTECTED.
  3. Open PushWarden from the Applications folder in your home folder to check and clean your GitHub repositories on guided screens.
  1. Paste this in a terminal. No sudo needed. 
    curl -fsSL https://pushwarden.com/install.sh | sh
    Prefer a package? .deb and .rpm

    Installed with sudo. It sets PushWarden up for the user who ran sudo.

    x86-64 .deb x86-64 .rpm ARM64 .deb ARM64 .rpm
  2. Check it. pushwarden status should say PROTECTED.
  3. Clean your GitHub. pushwarden ui opens the guided screens. Setting up a server? See Running on servers.

After installing, check it any time with pushwarden status. Every download is listed with its SHA-256 in checksums.txt, which is signed.