forkguard fix
Remove what forkguard found, on your computer, and get your original files back.
#Name
forkguard fix removes the malware forkguard found in a folder, and restores your original files from git history where it can. Nothing is pushed anywhere.
forkguard fix - remove detected malware from a folder
#Synopsis
forkguard fix
forkguard fix path/to/projectforkguard fix [folder]#Description
Runs a check, then applies the fix for every problem that has one. Cutting off the hidden code is the easy part. The malware also adds fake require lines to the top of files and sometimes mangles line breaks, so fix handles all of it and then checks again.
| Problem | What fix does |
|---|---|
Hidden init file | Deletes it |
| Fake font | Deletes it |
| Decoy fonts folder | Deletes the whole folder |
Dropped .bat or .orc files, history-rewriting scripts | Deletes them |
| Hidden code in one of your files | Cuts out only the hidden part and keeps your code |
| Env-variable loader block | Removes only that block |
Injected require lines | Removes only those lines |
node init && or a font file run in a script | Removes only that step from dev, build and start |
| VS Code auto-run task | Removes only that task and keeps your other tasks |
| VS Code automatic tasks setting | Turns it off |
config.bat in .gitignore | Removes that line |
.env not ignored | Adds .env* rules to .gitignore |
#Restoring your originals
After cleaning a file, forkguard looks back through git history for the last clean version of it. If that version has the same code (ignoring spacing), it puts back your exact original, so even line breaks the malware mangled come back.
#What it does not fix by itself
- A known bad npm package, a risky install script, an already installed bad package, and an infected npm. These need a person to decide, and forkguard tells you what to do.
- A file that matches a known signature but has nothing it can safely cut. It is left as is and reported again as “Still needs a look”.
- Committed
.envfiles stay on disk and in git. `forkguard pr` takes them out of git for you.
Applies fixes: delete, delete-dir, strip (hidden tail, loader, prelude), script, autorun, setting, gitignore, ignore-env. Restores the original bytes from history when the cleaned code equals a clean historical version modulo whitespace.
Does not fix: bad packages, lifecycle scripts, installed packages, infected npm, committed .env (use pr).
#Output
forkguard cleaning my-app
done init deleted
done package.json cleaned
done postcss.config.mjs restored your original from git history
Clean now. Review with "git diff", then commit.| Word | What happened |
|---|---|
deleted | The file was nothing but malware, so it is gone. |
cleaned | The file is yours. Only the bad part was removed. |
restored your original from git history | forkguard found the clean version you wrote before the attack and put it back exactly. |
removed the auto-run task, turned automatic tasks off | A VS Code task or setting was changed. |
If something is left, you get “Still needs a look” with the remaining findings.
done <file> deleted | cleaned | restored your original from git history
Clean now. exit 0
Still needs a look: remaining findings, exit 1 if any are HIGH#After it runs
Look at what changed, then save it:
git diff
git add -A
git commit -m "Remove injected malware"Want GitHub fixed too, not just your laptop? Use `forkguard pr` instead.
git diff; git add -A; git commit#Exit status
| Code | Meaning |
|---|---|
0 | Clean, or only MED findings. |
1 | Something HIGH was found. |
2 | forkguard itself could not run, for example a folder that does not exist. |
The same codes work in scripts and CI. See Exit codes.
0 clean, or MED findings only
1 a HIGH finding
2 error (for example a folder that does not exist)#Examples
forkguard fixforkguard fix ~/projects/old-siteforkguard fix
forkguard fix ./app