fix: Windows guard install, and lead every response path with rotation - #32
Merged
Conversation
A Windows user hit "could not create the scheduled task" with no further detail, having just found roughly fifteen infected repositories. guard install on Windows schtasks.exe is a Windows program and needs a Windows path for the executable it runs. It was being handed an MSYS path such as /usr/bin/bash, which cannot work. Worse, every error was discarded with 2>&1 >/dev/null, so the user saw a bare failure with nothing to act on and no way to report it usefully. It now converts the bash path with cygpath, sets MSYS_NO_PATHCONV so the /TN flags are not rewritten as paths, and PRINTS the actual schtasks error when it still fails. On failure it falls back to a Startup-folder entry, which needs no administrator rights, and if that is unavailable it explains how to run the guard by hand rather than leaving the user stuck. notify templates led with the wrong step Both the issue and the mail template said "delete your clone and re-clone" first and mentioned rotation second. Credentials are this family's objective, so rotation is first, npm write tokens ahead of everything else, and checking your own machine comes before cleaning any repository — cleaning first simply lets an infected machine re-inject. The mail template now spells out the full rotation list, including the clipboard, and warns about the Actions workflow that keeps exfiltrating secrets after the dropper is gone. docs: an incident-response walkthrough A new "If you're infected" section, placed before the command reference because that is the state someone arrives in. Rotate, clean the machine, then the repositories, then tell people — with the reasoning for the order rather than just the order. It also answers the question this user's output raised: `guard scan` reporting "clean" while repositories are infected is the expected result, not a contradiction. The loader runs when a build runs or an editor opens the folder, then exits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Windows user hit
could not create the scheduled taskwith no further detail, having just found ~15 infected repositories.guard install on Windows
schtasks.exeis a Windows program and needs a Windows path for the executable it runs — it was being handed an MSYS path like/usr/bin/bash. Worse, every error was discarded (>/dev/null 2>&1), so the user saw a bare failure with nothing to act on.Now: converts the path with
cygpath, setsMSYS_NO_PATHCONVso/TNisn't rewritten as a path, and prints the actual schtasks error. On failure it falls back to a Startup-folder entry (no admin rights), and failing that explains how to run the guard by hand.notify templates led with the wrong step
Both templates said "re-clone" first and mentioned rotation second. Credentials are the objective — rotation is first, npm write tokens ahead of everything, and checking your own machine comes before cleaning any repo, since cleaning first just lets an infected machine re-inject. The mail template now carries the full list including the clipboard, and warns about the Actions workflow that keeps exfiltrating after the dropper is gone.
docs: incident-response walkthrough
New "If you're infected" section, placed before the command reference because that's the state people arrive in. Rotate → clean the machine → repos → tell people, with the reasoning for the order.
It also answers what this user's output raised:
guard scansaying "clean" while repos are infected is expected, not a contradiction — the loader runs when a build runs or an editor opens the folder, then exits.