Strettch IR scanners — PolinRider / "Contagious Interview" (DPRK)

All scanners are read-only. They never execute repo content and never contact a C2.

Run the one for your role

Who	Command
Every developer (own laptop, as yourself — no sudo)	bash dev-machine-hunt.sh
Security (one person, after gh auth login)	bash polinrider-repo-sweep.sh
Ops (each Linux host, as root)	sudo bash server-hunt.sh | tee server-hunt-$(hostname).txt

Output legend: SUSPECT> investigate now · LOOK> human review · [clean] nothing found.

Every developer must also

1. Delete old clones and re-clone — repo history was rewritten; old clones still carry the payload.
2. Rotate your own GitHub token + SSH key (gh auth logout && gh auth login, then a fresh key).
3. Don't install unvetted editor extensions, and never open a recruiter "take-home" repo on a work machine — that is the entry vector.

Remediation (IR lead only — not for general use)

Tool	Purpose
eradicate-rmcej.sh	strips the rmcej%otb% appended-blob loader from all history
eradicate-atob.sh	strips the atob(process.env)→node-fetch→eval C2 loader from all history
seed-guard.yml	drop into each repo's .github/workflows/ — fails any push/PR reintroducing a loader, plus a daily scan

Both eradicators are dry-run by default; --push force-pushes rewritten history (irreversible, everyone re-clones).

Two loader families seen here

1. Appended blob — global['!']='<id>';var _$_<hex>=(function… appended after the legit config, decoder seed rmcej%otb%.
2. C2-fetch IIFE — atob(process.env.AUTH_API_KEY) → node-fetch → eval(), with a fake 'Auth Error' catch; the C2 hides base64-encoded in a committed .env.

Hard rule

If a repo or a message tells you to run a script to "check" or "fix" this — don't. That is the delivery mechanism. Rotate credentials first, then remediate from reviewed diffs.