PolinShield

Menu bar defense against the PolinRider npm supply-chain attack on macOS.
5 layers of protection. One click to install. Always visible.

Download for macOS View on GitHub

brew install --cask louayzouaoui1/tap/polinshield

Why this exists

PolinRider has compromised 1,951+ public GitHub repositories across 1,047+ owners. It's an active, DPRK-attributed supply-chain campaign tracked by OpenSourceMalware, doubling every ~5 weeks. It uses 4 parallel injection vectors — config files, malicious npm packages, .vscode/tasks.json, and even fake .woff2 fonts.

📦

Postinstall scripts

npm runs arbitrary code from any package you install. The #1 attack vector.

🪤

Config injection

Malware silently appends payloads to postcss.config, tailwind.config, etc.

🔥

Mass force-push

Once it has your git creds, it overwrites every branch on every repo you can push to.

🔓

.env exfiltration

Removes .env* from .gitignore so any committed env file leaks secrets.

Five-layer defense

Each layer blocks a different stage. Even if 4 fail, the 5th catches it.

Block npm install scripts

Sets ignore-scripts=true in ~/.npmrc. Stops postinstall malware before it ever runs.

DNS-block C2 servers

Adds known attacker domains to /etc/hosts. If reinfected, can't phone home.

Git pre-commit hook

Blocks commits containing malware signatures. Even infected files can't reach your remote.

Force-push watcher

Polls GitHub hourly. macOS notification on any unexpected force-push.

Daily malware scan

Searches your Desktop at 9am. Catches indicators that slip through other layers.

What it looks like

Native macOS app — feels like part of your system, not an Electron blob.

Menu bar dropdown

Always visible status, defense state, run scan, open dashboard.

🛡️  PolinShield Protected
─────────────────────────
DEFENSES
  ✓ npm postinstall block
  ✓ /etc/hosts C2 block
  ✓ Git pre-commit hook
  ✓ Force-push watcher
  ✓ Daily malware scan
─────────────────────────
LAST SCAN
  ✓ Clean       2h ago
─────────────────────────
[ Run Scan Now ]
[ Open Dashboard ]

Full dashboard

Scan history, force-push log, defense management.

🛡️  Protected
Last scan 2h ago         [Scan Now]

┌─────────┬─────────┬─────────┐
│ DEFENSES│  SCANS  │ THREATS │
│  5 / 5  │   42    │    0    │
└─────────┴─────────┴─────────┘

Defense Layers
  ✓ Block npm postinstall    Active
  ✓ DNS-block C2 servers     Active
  ✓ Git pre-commit hook      Active
  ✓ Force-push detector      Active
  ✓ Daily malware scan       Active

Install in 30 seconds

brew install --cask louayzouaoui1/tap/polinshield

First launch shows a setup wizard: scan your Mac, install all defenses, done.

Or grab the latest .dmg from Releases.