# opensourcemalware/polinrider architecture
> Architecture diagram of the GitHub repository opensourcemalware/polinrider, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-24). It is an AI-made overview: check details against the source.
- Interactive diagram: https://gitdiagram.com/opensourcemalware/polinrider
- Repository: https://github.com/opensourcemalware/polinrider
## Overview
1. **Repository purpose**
- This is a threat-intelligence and incident-response repository, not an application codebase.
- Its primary output is a living report on the “PolinRider” campaign, plus supporting victim lists, indicators of compromise, and cleanup guidance.
2. **Narrative/report layer**
- `README.md` is the main human-facing document and acts as the canonical briefing.
- It explains the campaign, infection vectors, obfuscator variants, C2 infrastructure, and recommended remediation.
- The README also embeds evidence images from `images/` to support the analysis.
3. **Victim corpus / reporting data**
- The root CSVs (`polinrider-master-2026-04-11.csv`, `polinrider-users-2026-04-11.csv`) are consolidated datasets of affected repositories and owners.
- The `archive/` directory contains older snapshots (`affected_repos_2026-03-18.csv`, `affected_users_2026-03-18.csv`) for historical comparison and scope tracking.
- These files are the repo’s structured data backbone for triage and trend analysis.
4. **Detection and validation tooling**
- `polinrider-scanner.sh` is the main executable artifact.
- It is a cross-platform shell scanner intended to detect known PolinRider signatures in local repositories and exits with a compromise status.
- In the repo’s workflow, this is the operational check that complements the static report.
5. **Windows-specific response playbook**
- `polinrider-windows-incident-response.md` is a dedicated remediation guide for Windows environments.
- It likely covers forensic cleanup and recovery steps aligned with the batch-file propagation technique described in the README.
- This is separate from the scanner, so detection and response are intentionally split.
6. **Evidence and presentation assets**
- `images/` stores banner and chart assets used in the report.
- These are not functional dependencies, but they support communication of scope, infection trends, and package/infrastructure examples.
7. **Historical and updated scope tracking**
- The repo is organized around repeated campaign hunts and versioned scope expansion.
- The CSV snapshots and the dated master/user lists show that this is an evolving intelligence corpus, not a one-time post.
- The README’s dated updates explain why multiple data snapshots exist side by side.
8. **Data flow inside the repo**
- External hunting and analysis produce victim/owner records.
- Those findings are normalized into CSVs, then summarized in the README.
- Scanner signatures and incident-response guidance are derived from the same findings, creating a loop from discovery to detection to remediation.
9. **Operational boundaries**
- There is no backend service, database, or web runtime in this repository.
- All functionality is offline and file-based: documentation, tabular evidence, scripts, and response notes.
- The main boundary is between human-readable intel and machine-usable detection artifacts.
10. **External systems referenced as part of the architecture**
- The report depends on GitHub search, npm, VS Code task execution, Vercel-hosted endpoints, and blockchain-backed C2 infrastructure as observed targets.
- Those systems are not implemented here, but they materially shape the repo because the scanner and report are built around their indicators.
- In diagram terms, this repo sits on the defender side: it consumes observed attacker infrastructure and turns it into searchable indicators and cleanup actions.
Main entry points: [`README.md`](https://github.com/opensourcemalware/polinrider/blob/main/README.md) (README), [`polinrider-master-2026-04-11.csv`](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-master-2026-04-11.csv) (Master scope), [`polinrider-users-2026-04-11.csv`](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-users-2026-04-11.csv) (User scope), [`polinrider-windows-incident-response.md`](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-windows-incident-response.md) (Windows IR)
## Diagram (Mermaid)
```mermaid
flowchart TD
subgraph group_grp_docs["Report & Response"]
node_n_readme["README
intel report
[README.md]"]
node_n_win_ir["Windows IR
remediation guide"]
end
subgraph group_grp_data["Victim Data"]
node_n_master_csv[("Master scope
victim dataset")]
node_n_user_csv[("User scope
victim dataset")]
node_n_archive_repos[("Old repos
historical csv")]
node_n_archive_users[("Old users
historical csv")]
end
subgraph group_grp_tooling["Detection Tooling"]
node_n_scanner["Scanner
shell detector"]
end
subgraph group_grp_assets["Evidence Assets"]
node_n_images["Images
evidence assets"]
end
node_n_signatures{{"Signatures
ioc set"}}
node_n_infra{{"Attacker infra
observed targets"}}
node_n_infection{{"Infection flow
campaign analysis"}}
node_n_response{{"Cleanup plan
response workflow"}}
node_n_readme -->|"embeds"| node_n_images
node_n_readme -->|"summarizes"| node_n_master_csv
node_n_readme -->|"summarizes"| node_n_user_csv
node_n_readme -->|"describes"| node_n_infection
node_n_readme -->|"tracks"| node_n_infra
node_n_readme -->|"recommends"| node_n_response
node_n_scanner -->|"checks"| node_n_signatures
node_n_signatures -->|"derived from"| node_n_readme
node_n_signatures -->|"matches"| node_n_infra
node_n_win_ir -->|"implements"| node_n_response
node_n_win_ir -->|"uses"| node_n_signatures
node_n_master_csv -->|"supersedes"| node_n_archive_repos
node_n_user_csv -->|"supersedes"| node_n_archive_users
node_n_master_csv -->|"feeds"| node_n_readme
node_n_user_csv -->|"feeds"| node_n_readme
node_n_archive_repos -->|"informs"| node_n_readme
node_n_archive_users -->|"informs"| node_n_readme
node_n_infection -->|"yields"| node_n_signatures
node_n_infection -->|"drives"| node_n_response
click node_n_readme "https://github.com/opensourcemalware/polinrider/blob/main/README.md"
click node_n_win_ir "https://github.com/opensourcemalware/polinrider/blob/main/polinrider-windows-incident-response.md"
click node_n_master_csv "https://github.com/opensourcemalware/polinrider/blob/main/polinrider-master-2026-04-11.csv"
click node_n_user_csv "https://github.com/opensourcemalware/polinrider/blob/main/polinrider-users-2026-04-11.csv"
click node_n_archive_repos "https://github.com/opensourcemalware/polinrider/blob/main/archive/affected_repos_2026-03-18.csv"
click node_n_archive_users "https://github.com/opensourcemalware/polinrider/blob/main/archive/affected_users_2026-03-18.csv"
click node_n_scanner "https://github.com/opensourcemalware/polinrider/blob/main/polinrider-scanner.sh"
click node_n_images "https://github.com/opensourcemalware/polinrider/tree/main/images"
classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_n_readme,node_n_win_ir toneBlue
class node_n_master_csv,node_n_user_csv,node_n_archive_repos,node_n_archive_users toneAmber
class node_n_scanner toneMint
class node_n_images toneRose
class node_n_signatures,node_n_infra,node_n_infection,node_n_response toneNeutral
```
## Components
### Report & Response
Human-facing briefing, remediation guidance, and supporting evidence presentation.
- [README](https://github.com/opensourcemalware/polinrider/blob/main/README.md): intel report · Canonical campaign briefing covering infection vectors, infrastructure, indicators, and remediation. · `README.md`
- [Windows IR](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-windows-incident-response.md): remediation guide · Windows-specific incident response and cleanup playbook. · `polinrider-windows-incident-response.md`
### Victim Data
Structured CSV snapshots used for scope tracking and trend analysis.
- [Master scope](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-master-2026-04-11.csv): victim dataset · Consolidated affected repository records for the current campaign snapshot. · `polinrider-master-2026-04-11.csv`
- [User scope](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-users-2026-04-11.csv): victim dataset · Consolidated affected owner/user records for the current campaign snapshot. · `polinrider-users-2026-04-11.csv`
- [Old repos](https://github.com/opensourcemalware/polinrider/blob/main/archive/affected_repos_2026-03-18.csv): historical csv · Earlier affected repository snapshot for comparison and scope tracking. · `archive/affected_repos_2026-03-18.csv`
- [Old users](https://github.com/opensourcemalware/polinrider/blob/main/archive/affected_users_2026-03-18.csv): historical csv · Earlier affected owner snapshot for comparison and scope tracking. · `archive/affected_users_2026-03-18.csv`
### Detection Tooling
Operational scanner for local compromise checks.
- [Scanner](https://github.com/opensourcemalware/polinrider/blob/main/polinrider-scanner.sh): shell detector · Cross-platform shell script that detects PolinRider signatures in local repositories. · `polinrider-scanner.sh`
### Evidence Assets
Images used by the report.
- [Images](https://github.com/opensourcemalware/polinrider/tree/main/images): evidence assets · Charts and banner images embedded in the report. · `images`
### Other components
- **Signatures**: ioc set · Detection patterns and compromise indicators derived from campaign analysis.
- **Attacker infra**: observed targets · Referenced external infrastructure such as C2, hosting, and platform-abuse indicators.
- **Infection flow**: campaign analysis · Observed propagation and payload behavior summarized in the report.
- **Cleanup plan**: response workflow · Remediation actions and recovery steps synthesized from the findings.
## Connections
- README → Images: embeds · The report uses images as supporting evidence.
- README → Master scope: summarizes · The report is grounded in the current victim dataset.
- README → User scope: summarizes · The report is grounded in the current owner dataset.
- README → Infection flow: describes · The report explains campaign behavior and propagation.
- README → Attacker infra: tracks · The report documents observed attacker infrastructure and endpoints.
- README → Cleanup plan: recommends · The report includes remediation and recovery guidance.
- Scanner → Signatures: checks · The scanner evaluates local repos against known indicators.
- Signatures → README: derived from · Indicators are derived from the analysis in the briefing.
- Signatures → Attacker infra: matches · Indicators are tied to observed attacker infrastructure and artifacts.
- Windows IR → Cleanup plan: implements · The Windows playbook operationalizes cleanup guidance.
- Windows IR → Signatures: uses · The playbook aligns response steps with known detection signals.
- Master scope → Old repos: supersedes · The current repository scope snapshot replaces older records.
- User scope → Old users: supersedes · The current owner scope snapshot replaces older records.
- Master scope → README: feeds · Structured findings are summarized in the briefing.
- User scope → README: feeds · Structured findings are summarized in the briefing.
- Old repos → README: informs · Historical snapshots support trend and scope comparison.
- Old users → README: informs · Historical snapshots support trend and scope comparison.
- Infection flow → Signatures: yields · Behavioral analysis produces detection signatures.
- Infection flow → Cleanup plan: drives · Infection analysis informs the cleanup plan.