How opensourcemalware/polinrider works
1. Repository purpose
- This is a threat-intelligence and incident-response repository, not an application codebase.
- Its primary output is a living report on the “PolinRider” campaign, plus supporting victim lists, indicators of compromise, and cleanup guidance.
2. Narrative/report layer
- README.md is the main human-facing document and acts as the canonical briefing.
- It explains the campaign, infection vectors, obfuscator variants, C2 infrastructure, and recommended remediation.
- The README also embeds evidence images from images/ to support the analysis.
3. Victim corpus / reporting data
- The root CSVs (polinrider-master-2026-04-11.csv, polinrider-users-2026-04-11.csv) are consolidated datasets of affected repositories and owners.
- The archive/ directory contains older snapshots (affected_repos_2026-03-18.csv, affected_users_2026-03-18.csv) for historical comparison and scope tracking.
- These files are the repo’s structured data backbone for triage and trend analysis.
4. Detection and validation tooling
- polinrider-scanner.sh is the main executable artifact.
- It is a cross-platform shell scanner intended to detect known PolinRider signatures in local repositories and exits with a compromise status.
- In the repo’s workflow, this is the operational check that complements the static report.
5. Windows-specific response playbook
- polinrider-windows-incident-response.md is a dedicated remediation guide for Windows environments.
- It likely covers forensic cleanup and recovery steps aligned with the batch-file propagation technique described in the README.
- This is separate from the scanner, so detection and response are intentionally split.
6. Evidence and presentation assets
- images/ stores banner and chart assets used in the report.
- These are not functional dependencies, but they support communication of scope, infection trends, and package/infrastructure examples.
7. Historical and updated scope tracking
- The repo is organized around repeated campaign hunts and versioned scope expansion.
- The CSV snapshots and the dated master/user lists show that this is an evolving intelligence corpus, not a one-time post.
- The README’s dated updates explain why multiple data snapshots exist side by side.
8. Data flow inside the repo
- External hunting and analysis produce victim/owner records.
- Those findings are normalized into CSVs, then summarized in the README.
- Scanner signatures and incident-response guidance are derived from the same findings, creating a loop from discovery to detection to remediation.
9. Operational boundaries
- There is no backend service, database, or web runtime in this repository.
- All functionality is offline and file-based: documentation, tabular evidence, scripts, and response notes.
- The main boundary is between human-readable intel and machine-usable detection artifacts.
10. External systems referenced as part of the architecture
- The report depends on GitHub search, npm, VS Code task execution, Vercel-hosted endpoints, and blockchain-backed C2 infrastructure as observed targets.
- Those systems are not implemented here, but they materially shape the repo because the scanner and report are built around their indicators.
- In diagram terms, this repo sits on the defender side: it consumes observed attacker infrastructure and turns it into searchable indicators and cleanup actions.
Main entry points: README.md README · polinrider-master-2026-04-11.csv Master scope · polinrider-users-2026-04-11.csv User scope · polinrider-windows-incident-response.md Windows IR
Components 12
Report & Response
Human-facing briefing, remediation guidance, and supporting evidence presentation.
- README · Canonical campaign briefing covering infection vectors, infrastructure, indicators, and remediation.
README.md - Windows IR · Windows-specific incident response and cleanup playbook.
polinrider-windows-incident-response.md
Victim Data
Structured CSV snapshots used for scope tracking and trend analysis.
- Master scope · Consolidated affected repository records for the current campaign snapshot.
polinrider-master-2026-04-11.csv - User scope · Consolidated affected owner/user records for the current campaign snapshot.
polinrider-users-2026-04-11.csv - Old repos · Earlier affected repository snapshot for comparison and scope tracking.
archive/affected_repos_2026-03-18.csv - Old users · Earlier affected owner snapshot for comparison and scope tracking.
archive/affected_users_2026-03-18.csv
Detection Tooling
Operational scanner for local compromise checks.
- Scanner · Cross-platform shell script that detects PolinRider signatures in local repositories.
polinrider-scanner.sh
Evidence Assets
Images used by the report.
- Images · Charts and banner images embedded in the report.
images
Other components
- Signatures · Detection patterns and compromise indicators derived from campaign analysis.
- Attacker infra · Referenced external infrastructure such as C2, hosting, and platform-abuse indicators.
- Infection flow · Observed propagation and payload behavior summarized in the report.
- Cleanup plan · Remediation actions and recovery steps synthesized from the findings.
Connections 19
- README → Images: embeds · The report uses images as supporting evidence.
- README → Master scope: summarizes · The report is grounded in the current victim dataset.
- README → User scope: summarizes · The report is grounded in the current owner dataset.
- README → Infection flow: describes · The report explains campaign behavior and propagation.
- README → Attacker infra: tracks · The report documents observed attacker infrastructure and endpoints.
- README → Cleanup plan: recommends · The report includes remediation and recovery guidance.
- Scanner → Signatures: checks · The scanner evaluates local repos against known indicators.
- Signatures → README: derived from · Indicators are derived from the analysis in the briefing.
- Signatures → Attacker infra: matches · Indicators are tied to observed attacker infrastructure and artifacts.
- Windows IR → Cleanup plan: implements · The Windows playbook operationalizes cleanup guidance.
- Windows IR → Signatures: uses · The playbook aligns response steps with known detection signals.
- Master scope → Old repos: supersedes · The current repository scope snapshot replaces older records.
- User scope → Old users: supersedes · The current owner scope snapshot replaces older records.
- Master scope → README: feeds · Structured findings are summarized in the briefing.
- User scope → README: feeds · Structured findings are summarized in the briefing.
- Old repos → README: informs · Historical snapshots support trend and scope comparison.
- Old users → README: informs · Historical snapshots support trend and scope comparison.
- Infection flow → Signatures: yields · Behavioral analysis produces detection signatures.
- Infection flow → Cleanup plan: drives · Infection analysis informs the cleanup plan.