# PushWarden

> PushWarden is a tool that protects developer machines and GitHub repositories from the PolinRider / Contagious Interview supply-chain malware. It is a single program for Linux, macOS and Windows: a background guard with real-time file protection, an on-demand scanner, a C2 firewall block, editor hardening, and a command that checks every branch of every GitHub repository you can push to. Detection and protection are free; PushWarden Pro adds removing just the malicious part of a file and fixing GitHub repositories.

Every feature is a subcommand of `pushwarden`. It installs per user without administrator rights, every destructive action is reversible through a quarantine, and nothing leaves the machine unless the user opts in. The links below are Markdown sources. The same pages are rendered at https://pushwarden.com/guide/overview.html, and the whole documentation is one file at https://pushwarden.com/llms-full.txt.

## Start here

- [Overview](https://pushwarden.com/md/guide/overview.md): What PushWarden is, the threat it protects against, every feature it has and the platforms it supports.
- [Installation](https://pushwarden.com/md/guide/installation.md): How to install, update and remove PushWarden on Linux, macOS and Windows, and what the installer changes on the machine.
- [Quick start](https://pushwarden.com/md/guide/quick-start.md): The PushWarden commands used most often, with one line on what each does.
- [Moving from ThreatScan](https://pushwarden.com/md/guide/moving-from-threatscan.md): PushWarden is the new name of ThreatScan. What was renamed in version 0.5.0, what keeps working, and the steps to move an existing ThreatScan installation.
- [How it works](https://pushwarden.com/md/guide/how-it-works.md): The architecture of PushWarden: the four protection layers, the path from detection to response, and where data is stored.
- [Free and Pro](https://pushwarden.com/md/guide/pro.md): What the free version of PushWarden does, what PushWarden Pro adds, how a licence key is tied to a number of devices, and how to activate, check and remove it.

## Protection

- [What it detects](https://pushwarden.com/md/guide/detection.md): Every category of finding PushWarden reports, in repositories and on the host, with severities, threat names and how indicators are managed.
- [What it covers](https://pushwarden.com/md/guide/coverage.md): Which developer-targeted malware families PushWarden checks for, what it only reports, and what it cannot see.
- [Scanning](https://pushwarden.com/md/guide/scanning.md): How to run an on-demand scan of repositories and the host with pushwarden scan: options, behaviour when something is found, reports and exit codes.
- [Real-time guard](https://pushwarden.com/md/guide/real-time-guard.md): The background guard: real-time file protection, process and network checks, scheduled sweeps, notifications, dialogs and how to check that it is running.
- [Running on servers](https://pushwarden.com/md/guide/servers.md): Install PushWarden on a Linux server as a system service that starts at boot with no dialogs, choose what it may change, get alerts, scan from cron or a container, and remove it.
- [Response and recovery](https://pushwarden.com/md/guide/response-and-recovery.md): What PushWarden does with a malicious file or process, how quarantine works, how to restore or allow a file, and the steps to take after an infection.
- [Blocking C2 servers](https://pushwarden.com/md/guide/network-block.md): How pushwarden protect blocks the malware's command-and-control servers at the firewall and in the hosts file, system-wide and across reboots.
- [Hardening](https://pushwarden.com/md/guide/hardening.md): Preventive settings PushWarden applies to VS Code-family editors and npm so that opening a malicious project does not run code.

## GitHub

- [Cleaning GitHub repositories](https://pushwarden.com/md/guide/github-clean.md): How pushwarden github-clean removes PolinRider from every branch of every GitHub repository you can push to, with dry run, resume, token handling and exit codes.
- [Guided screens](https://pushwarden.com/md/guide/guided-screens.md): pushwarden ui: the easy way to check and clean your GitHub repositories. Guided screens walk you through it, from the Start menu on Windows or the Applications folder on macOS.
- [CI and automation](https://pushwarden.com/md/guide/ci-and-automation.md): Using PushWarden in pipelines and scripts: the reusable GitHub Actions workflow, a CI gate, the pre-commit hook, JSON output and exit codes.

## Operating it

- [Activity history](https://pushwarden.com/md/guide/activity-history.md): The journal that records every finding, action, decision, sweep and error, and how to read and filter it with pushwarden history and pushwarden alerts.
- [Team reporting](https://pushwarden.com/md/guide/team-reporting.md): The two ways information can leave a machine on your say-so: webhook alerts and the feedback bundle you send by hand, with exactly what each contains.
- [Updates](https://pushwarden.com/md/guide/updates.md): How PushWarden keeps its indicators and itself up to date: daily indicator refresh, signed program updates, rollback, channels and how to turn updates off.
- [Disk use and cleanup](https://pushwarden.com/md/guide/disk-and-cleanup.md): Every store PushWarden keeps on disk, the size or age limit of each, and how pushwarden cleanup and the daily housekeeping enforce them.
- [Configuration](https://pushwarden.com/md/guide/configuration.md): Every PushWarden setting with its default, every file in the data directory, and every environment variable.

## Reference

- [Security and privacy](https://pushwarden.com/md/guide/security-and-privacy.md): The trust model of PushWarden: what runs with which privileges, how tokens and updates are protected, and exactly what data can leave the machine.
- [Troubleshooting and FAQ](https://pushwarden.com/md/guide/troubleshooting.md): Solutions to common PushWarden problems and answers to frequent questions about detection, performance, privacy and removal.
- [Command-line reference](https://pushwarden.com/md/CLI.md): Every PushWarden command with all options, exit codes, configuration keys, files and environment variables. The same text as pushwarden help.

## Optional

- [Whole documentation in one file](https://pushwarden.com/llms-full.txt): every page above, concatenated
- [Indicator file](https://downloads.pushwarden.com/iocs.json): every signature, key, hash and C2 address the scanner uses