PushWarden What it covers
PushWarden began as a hunter for PolinRider. Other campaigns now go after developers in much the same ways, so it also looks for the tricks they share. This page says, family by family, what it checks, what it only reports, and what it cannot see. The full list of rules is on What it detects.
Last reviewed: 15 October 2026. Campaigns move fast, so check the sources at the bottom for the newest details.
Family by family
| Family | How it reaches you | What PushWarden checks | What it does |
|---|---|---|---|
| PolinRider | Code appended to config files in repositories and packages, a fake font, an editor task that runs when a folder opens, history rewriting | Signatures, padding, fake fonts, tasks, propagation scripts, blockchain lookups, command servers, git history | Quarantines the file; Pro removes only the payload |
| Shai-Hulud (npm worm) | An install script in a package runs a file that steals tokens and republishes packages | The worm’s file names and the planted workflow, install scripts that run them, repositories in your account named like its data dumps | Reports; never moves package.json |
| GlassWorm | Code hidden in characters that draw nothing | Long runs of invisible characters, critical when the same file decodes and runs text | Quarantines the file |
| s1ngularity (Nx) | An install script starts your own AI coding tool with its safety checks off and asks it to find secrets | Install scripts that start claude, gemini, codex and similar with the flags that skip confirmation |
Reports |
| Contagious Interview | A fake job-interview project with a keylogger and a screen grabber | The dependency pair that only appears together in those projects | Reports |
| Mini Shai-Hulud and AI assistant hooks | A hook or task that runs a hidden script when you open the folder in an editor or AI tool | .vscode/tasks.json, .claude/settings.json hooks, MCP files, rules files such as CLAUDE.md, text hidden in invisible characters |
Reports; autorun tasks that download code are quarantined |
| Dropper tricks in git and CI | Settings in .git/config, a git hook, a dev container or a workflow that runs a command |
Git settings that run code, hooks, dev container commands, workflows that send out all secrets or install a runner | Reports; hooks and tasks that download code are quarantined |
What gets acted on and what only gets reported
PushWarden acts by itself only when code runs on its own and the evidence is strong. A warning about a pull request trigger or a rules file is for you to read, not something it moves or deletes. Words inside a string or comment are never treated as a call, and ordinary settings such as less, code --wait or git-lfs are left alone.
Deeper checks
pushwarden scan --historyreads every file version ever committed, so a payload that a later commit hid but a fresh clone still downloads is found. It prints thegit filter-repocommand for you to review and never rewrites history itself.- A file too large to read whole still has its last megabyte checked, because a payload is added to the end.
pushwarden github-cleanfixes infected branches with a normal commit on top. It does not force-push, because PolinRider itself rewrites history and a force-push can lose a teammate’s work.
What it cannot see
PushWarden is not a replacement for a managed security service or a package firewall.
- It does not sit in front of
npm installto block a bad package before it arrives. Tools that watch the package registry do that. PushWarden finds the effects on your machine and in your code. - It does not watch what every program does all day. A managed detection service with analysts does that. PushWarden checks running processes and connections against known markers.
- It cannot know about a campaign before its markers are published. The tricks it checks for catch many new variants, and the indicator list updates without a new release.
- If someone else rewrites a repository’s history, PushWarden can find the damage in your copy and in repositories you own, but it cannot stop them.
Keeping up
New findings are added as data first: names, hosts, file names and patterns live in the indicator file, so pushwarden update brings them without a new version. A new campaign gets a harmless sample in the test suite, a rule, a clean sample that must stay clean, and a run over real projects to check for false alarms before it ships.