PushWarden

Developer malware protection · Linux · macOS · Windows

Malware hides in the code you trust. PushWarden finds it, removes it and keeps it out.

Fake job-interview projects, poisoned packages and infected GitHub repositories are how attackers reach developers now. PushWarden scans your computer, stops the malware before it runs, and cleans every infected branch on your GitHub, in minutes.

Download free See GitHub clean

Choose your system below.

The real program, recorded: a scan of an infected interview project, then four GitHub repositories checked and cleaned. 47 seconds, no sound.
  • Free to start
  • No administrator rights
  • Signed updates
  • Everything it moves can be put back
Works with
  • Linux
  • macOS
  • Windows
  • GitHub
  • VS Code and Cursor
  • Claude Code and MCP configs
  • GitHub Actions
Active campaign

PolinRider reached 2,000+ GitHub owners and 4,000+ repositories between March and September 2026. It is attributed to DPRK (Lazarus) operators and spreads through ordinary projects. What PushWarden checks, and what it cannot see

Why you need it

Your antivirus does not read your repositories

Attackers stopped targeting programs and started targeting the files developers open every day. Most people only find out when a colleague, or GitHub, tells them.

You run code you did not write

Cloning a project, opening it in your editor and running npm install all run someone else's code. A fake recruiter's "coding test" only needs you to open the folder.

The payload looks like a normal file

It is appended to postcss.config.mjs, saved as a "font", hidden behind hundreds of spaces, or written in characters that draw nothing. Nothing looks wrong in your editor.

One stolen token infects your team

With your GitHub token the malware rewrites repositories and force-pushes itself to every branch it can reach. Colleagues who pull become the next victims.

Made for freelancers taking interview projects · maintainers · startups with a GitHub organisation · anyone who clones code from people they have never met.

How it stops the attack

It steps in at every stage, not just one

Most tools check one thing, once. PushWarden watches the whole path from clone to spread.

  1. 1 · Clone

    The infected project lands

    PushWarden: a new file is checked within a second of being written.

  2. 2 · Open

    The editor runs a hidden task

    PushWarden: flags the autorun task, and your editor is set so a folder cannot run anything by itself.

  3. 3 · Steal

    Tokens and keys are sent out

    PushWarden: the malware's servers are blocked at the firewall and running programs are checked every five seconds.

  4. 4 · Spread

    Your repositories get infected

    PushWarden: finds every infected branch on GitHub and cleans each with one normal commit.

GitHub clean

Your whole GitHub, cleaned. Every branch.

PolinRider does not infect one repository. It infects all of them. PushWarden checks every repository you can push to, shows you what it found, and fixes each infected branch for you.

  • See everything first. A dry run lists each infected branch and file. It changes nothing.
  • One normal commit per branch. Your history is never rewritten and nothing is force-pushed, so teammates just pull.
  • Safe to stop. Take a break whenever you like and carry on where you left off.
  • No new sign-in. It uses the GitHub login already on your computer.
  • Commands or screens. pushwarden github-clean, or open the guided screens.
1 · Check (free)
2 · Fix and push (Pro)

Checking is free. Fixing and pushing comes with PushWarden Pro. How github-clean works · Guided screens. Output shown is from the real program on four demo repositories.

Results

Tested on real code, not just claimed

These are numbers from our own checks on 15 October 2026. We say what they mean, and what they do not.

0high-severity false alarms in a deep scan of about 255,000 files across 24 real projects, node_modules included
412indicator entries built from 13 named public sources and our own rules, refreshed daily without a new release
7malware families covered: PolinRider, Shai-Hulud, GlassWorm, s1ngularity, Contagious Interview, Mini Shai-Hulud, git and CI droppers
200+automated tests, with an inert sample of each campaign and clean projects that must stay clean

What you can count on

  • Files are moved to a quarantine, never deleted. Put any back with one command.
  • Nothing leaves your machine unless you set an alert webhook. No telemetry.
  • Updates are verified with ed25519 and SHA-256 before they are installed.

What it is not

  • Not a general antivirus. It looks for developer-targeted malware and complements your antivirus.
  • Not a package firewall. It cannot block a bad package before it arrives.
  • It can only know a campaign once its markers are published. Generic rules catch many new variants.

Every family, check by check, with sources · Security and privacy

Protection

Install it once. It has your back.

It runs quietly in the background. Anything it removes you can put back, and it always tells you why it acted.

Always watching

A new file is checked within a second of being written. Programs and network connections are checked every five seconds.

Real-time guard

Nothing is lost

A bad file is locked away before it can run, with the reason. Changed your mind? Put it back with one command.

Response and recovery

The attackers are cut off

Your computer is stopped from talking to the malware's servers, so nothing can be sent. The block stays after a restart.

Blocking C2 servers

Safe to open a project

VS Code and similar editors are set so opening a folder cannot run anything on its own.

Hardening

Keeps it out of your team's code

Stops an infected commit before it is made, and fails the build if one slips into a pull request.

CI and automation

Runs on servers too

One command installs it as a system service that starts at boot, with no one at the screen.

Running on servers

Free and Pro

Protection is free. Pro does the clean-up for you.

Both versions find the malware and stop it from running. Pro saves you the work that comes after.

Free

For everyone

  • Always watching your projects, programs and connections
  • Stops the malware: infected files are locked away before they can run
  • Cuts off the attackers and makes your editors safe
  • Checks your GitHub and shows every infected branch
Get PushWarden

Pro

Everything in Free, plus

  • Fixes your GitHub: every infected branch is cleaned and pushed for you, on screen or from the terminal
  • Keeps your files: only the malicious part is removed, your own code stays where it is
  • Unlocks in seconds: pushwarden activate with your key
About Pro

Questions

Before you install

Is this an antivirus?

No. It is built for the malware that targets developers: infected projects, packages, editor tasks and repositories. Keep your antivirus too. See exactly what it covers and what it cannot see.

Does it send my code or file names anywhere?

No. There is no telemetry. It downloads updates and the indicator list, and with a Pro key it checks the licence about once a day. Alerts go to a webhook only if you set one. The full list is on the security page.

Will it delete my files?

It moves them to a quarantine and tells you why, and you can put any file back. The free version moves the whole infected file. Pro removes only the malicious part. It never force-pushes or rewrites git history.

Does it need administrator rights?

No. It installs and runs as your user. Blocking the malware's servers at the firewall asks for administrator rights once, and you can skip that step.

What if it finds nothing?

Then it stays quiet. pushwarden status shows that every protection layer is on and when the last full check ran.

Find it. Remove it. Keep it out.

Install PushWarden in a minute. It is free to start, needs no administrator rights, and every file it moves can be put back.

Download free Read the quick start

Install

Get PushWarden

One step, and only for your own user account. Coming from ThreatScan, the earlier name of this program? See moving to PushWarden. Installing on a server? There is a server install that starts at boot and needs no one at the screen.

Windows 10 and 11 your system

PushWarden-Setup.exe

The installer is not code-signed yet. If SmartScreen appears, choose More info, then Run anyway.

Afterwards, open PushWarden from the Start menu to check and clean your GitHub repositories on guided screens.

macOS 11 or later your system

Intel and Apple silicon. Open Terminal (Applications, Utilities, Terminal), paste this and press Return. No password needed:

curl -fsSL https://pushwarden.com/install.sh | sh

It downloads PushWarden, checks its SHA-256 against the published list, and sets it up for your user.

Prefer an installer? PushWarden.pkg

The package is not notarized yet, so macOS blocks it the first time ("unidentified developer"). Try to open it once, then go to System Settings, Privacy & Security, and click Open Anyway (it appears for about an hour). Or install it from Terminal: installer -pkg ~/Downloads/PushWarden.pkg -target CurrentUserHomeDirectory

Afterwards, open PushWarden from the Applications folder in your home folder to check and clean your GitHub repositories on guided screens.

Linux your system

Run in a terminal (no sudo):

curl -fsSL https://pushwarden.com/install.sh | sh

Or install a package (with sudo; it sets PushWarden up for your user):

Afterwards, pushwarden ui checks and cleans your GitHub repositories on guided screens.

After installing, check it any time with pushwarden status. Every download is listed with its SHA-256 in checksums.txt, which is signed.