Scans local and global file systems for PolinRider malware using built-in utilities.
npx skills add https://github.com/finom/finom --skill polinrider-scan
Please help me install this Agent Skill. Skill: polinrider-scan Source: https://github.com/finom/finom/tree/main/skills/polinrider-scan Command: npx skills add https://github.com/finom/finom --skill polinrider-scan
PolinRider is a DPRK/Lazarus supply-chain malware that targets JavaScript and Node.js developers by infecting build config files, malicious npm packages, and VS Code droppers to exfiltrate credentials, crypto assets, and propagate via git force-pushes. This Skill provides a comprehensive, no-dependency scan to identify active infections, residual indicators of compromise (IOCs), and propagation artifacts on both local project directories and entire global systems.
Trigger a scan by asking Claude to scan for PolinRider locally to check your current project, or scan for PolinRider globally to check your entire home directory.
High-intent search queries and answers about installing and using this skill.
You can scan for PolinRider malware by triggering a local scan to check your current project directory, or a global scan to check your entire home directory for active threats, residual IOCs, and propagation artifacts.
PolinRider is a DPRK/Lazarus supply-chain malware that targets JavaScript and Node.js developers by infecting build configs, malicious npm packages, and VS Code droppers to exfiltrate credentials, crypto assets, and propagate via git force-pushes.
To detect active malware C2 connections and malicious npm packages, run a scan that identifies running malware processes, live C2 endpoints, known obfuscation signatures, VS Code droppers, and fake binary payloads using standard built-in system utilities.
Yes, you can check for PolinRider infections without dependencies because the scan uses only standard built-in system utilities to identify active threats, compromised VS Code extensions, and tampered build configs.
To remove PolinRider persistence mechanisms and rotate compromised credentials, follow the scan's guided remediation instructions to kill active threats, clean infected files, remove propagation scripts, and execute credential rotation.
You should scan for PolinRider if you installed an affected npm package or used a compromised VS Code extension between March and April 2026, to confirm whether your machine or projects are infected.
FlexNetOSResume interrupted harness loops by restoring context and verifying system integrity.
drvossDetect hardcoded API keys, tokens, and passwords in source code and git history.
GoldenWing-360Audit dependencies and enforce lockfile hygiene to detect supply chain threats.
yocxy2Automate security audits and threat modeling for software repositories.
