GCVE-110-OSM-2023-423

PolinRider malware fork of calcom/cal.diy (48,538 stars) with an ACTIVE OPEN pull request (#27220) carrying the payload into the upstream project. Account has a long legitimate contribution history to cal.diy since 2023, consistent with account takeover rather than a throwaway attacker account. === UPSTREAM INJECTION ATTEMPT (ACTIVE OPEN PR) === Attack type: Fork-and-PR upstream injection Fork repo: abhijeetsingh-22/cal.com Parent repo: calcom/cal.diy (48,538 stars) Fork created: 2023-04-29 === PAYLOAD === Infected files: apps/web/postcss.config.mjs, packages/embeds/embed-core/postcss.config.mjs Signature: primary v1 (rmcej%otb%,2857687) + global['!']=... + _$_1e42 decoder, verified present verbatim at PR head commit fa29448e export default config;global['!']='9-5194-5';var _$_1e42=(function(l,e){...})("rmcej%otb%",2857687);global[_$_1e42[0]]=require;... === PR STATUS === PR #27220 to calcom/cal.diy: OPEN since 2026-01-25, still open as of 2026-09-18 Large 100-file PR - payload buried among legitimate-looking changes Parent infected: No (near miss, but PR is live and mergeable at any time)