GCVE-110-OSM-2025-129

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published November 28, 2025

PolinRider upstream injection attempt. Compromised developer AdnanAftab1 submitted PR #8391 titled Update Next.js example links in README which injected PolinRider malware payload into 13 postcss.config.mjs files. PR was caught and closed without merging. Attack type: PR-based upstream injection. Target: prisma/prisma-examples. PR: https://github.com/prisma/prisma-examples/pull/8391. Author: AdnanAftab1 (compromised). Status: CLOSED. Signature: rmcej otb 2857687 in 13 postcss.config.mjs files. C2: trongrid.io TRON blockchain.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown		* (affected)	—

References

Malicious package:

advisory

Browse GCVE Records

73,040 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON