GCVE-110-OSM-2025-1098

PolinRider malware merged into hngprojects/personal-trainer-fe via 2 separate feature-disguised PRs (#1, #5), now no longer present in postcss.config.mjs on the current default branch (silently overwritten by later commits, not an explicit security fix). === CONFIRMED UPSTREAM INFECTION - MERGED, NOW REMOVED === Repo: hngprojects/personal-trainer-fe Infected file (at time of PRs): postcss.config.mjs Signature: primary v1 (rmcej%otb%,2857687) + global['!'] + _$_1e42 decoder, confirmed present in PR diffs Disguised PR titles: "feat: refactor landing page and update design system" (#1), "feat:add-contact-page" (#5) - both merged, neither mentions security === CURRENT STATUS === Verified current postcss.config.mjs on default branch (dev) - payload no longer present. Removal was NOT via an explicit security-labeled commit, appears to have been silently overwritten by subsequent unrelated development.