What it detects

Looking for the families PushWarden covers rather than the rules? See What it covers.

PushWarden looks for the artefacts and behaviour of the PolinRider / Contagious Interview campaign in two places: your repositories and the computer itself. It also has generic rules for the tricks this kind of malware uses, so a new campaign with different strings is still caught. Every finding has a severity, a category, a threat name, the evidence and a one-sentence reason.

Severities

Scan commands exit with code 1 when anything HIGH or CRITICAL is found.

In repositories

Every script, config, font, image and .vscode/*.json file in a project is checked, not only files with well-known names. node_modules and vendor are skipped unless --deep or deep=true is set.

Beyond PolinRider

Campaigns change their strings; their tricks stay the same. These rules look for the trick itself, whatever the campaign. They act on their own only when the code runs by itself and the evidence is strong; everything else is an alert for you to review. On the same file, a PolinRider finding takes precedence and keeps its PolinRider name.

“Downloads and runs” means a command that fetches code and executes it in one go, such as piping curl or wget into a shell, Invoke-WebRequest into Invoke-Expression, an encoded PowerShell command, node -e or python -c with decoding or network code, or certutil, mshta and bitsadmin downloads. Downloading a file without running it is not flagged. The patterns are in the indicator file (download_exec_regexes, exec_sink_regexes, hidden_padding_min), so they are tuned through the daily indicator update. The newer family rules (worm_files, ai_cli_abuse_regexes, suspicious_dep_sets) work the same way. A file too large to read whole still has its last megabyte checked, because a payload is appended to the end.

On the host

Host checks run in scan (unless --no-system) and in the guard’s full sweep. Process and network checks also run every 5 seconds.

Threat names

Notifications, dialogs, reports and the history name threats in the style of Windows Defender, so an alert is recognisable at a glance.

Windows Defender itself names the family Trojan:JS/PolinRider.DB!MTB.

Reasons on every finding

Every finding has a why line: one sentence that says what the evidence means and why it has that severity. Every response has a response line: what was done and why (killed, stripped, quarantined, or left for you to decide).

These lines appear in scan output, dialogs, pushwarden alerts, pushwarden history, desktop notifications, the webhook JSON (reasons array) and guard.log.

Indicators are data

All indicators live in one file, iocs.json: signature strings and regular expressions, XOR keys, wallet addresses, C2 IPs and hostnames, URL paths, loader hashes, process markers and compromised package versions.

• The program carries an embedded copy, so it works offline from the first run.
• The guard downloads a newer copy from the project repository every 24 hours. The download is parsed and validated before it replaces the previous copy: every regular expression must compile, every IP and hash must be well formed, and the version must be newer.
• pushwarden update-iocs forces a download. --url and the ioc_update_url setting point it at a mirror or a fork.
• New variants are usually covered by adding an indicator, with no new release.

The current list is in pushwarden/iocs.json in the repository.

Kill list versus report list

A process is killed only when its command line holds a strict marker that legitimate tools never use. A broad indicator alone is reported but not killed, and the reason says so. This is what keeps ordinary node processes safe.

Files that legitimately contain signatures

Rule sets, tests and indicator databases contain the same strings the scanner looks for. Such a file opts out by carrying the token pushwarden:allow-signatures in its first 512 bytes.

The token is never honoured for config files, entry files, asset files or JavaScript and TypeScript files, so malware cannot use it to hide.

False positives

If a legitimate file is flagged:

pushwarden history --allow PATH --note "what the file really is"

This restores the file, stops flagging that exact content for 30 days, and records the note as feedback. Use exclude in the configuration to skip a directory entirely. See Response and recovery.