GCVE-110-OSM-2025-1105

PolinRider malware fork of danny-avila/LibreChat (44343 stars) staging upstream injection using a previously-undocumented marker variant (global.i="A#-" instead of the known global['!']/global['_V']/globalThis.i= markers). A build/lint config file in the fork contains the payload (exact path not individually re-confirmed this pass; bucket-level content verification confirmed genuine). === UPSTREAM INJECTION ATTEMPT === Attack type: Fork-and-PR upstream injection Fork repo: AiProject2025/LibreChat Parent repo: danny-avila/LibreChat (44343 stars) Fork created: 2025-07-10T20:21:20Z === PAYLOAD === Infected file: build/lint config file (exact path not re-confirmed this pass) Signature: new variant marker global.i="A#-..." (javascript-obfuscator.io-style hex/opcode packing, internally remaps to global['_V']) - not caught by previously-documented v1/v2/v3 PolinRider signatures === PR STATUS === PRs to parent: none found Parent infected: No (near miss)