GCVE-110-OSM-2025-181

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster) using a NEW VARIANT of the obfuscator. The threat actor has rotated their unique fingerprints — the marker string is now 'Cot%3t=shtP' (was 'rmcej%otb%'), shuffle seed is 1111436 (was 2857687), function name is 'MDy' (was '_$_1e42') — but the architecture is identical: obfuscated JavaScript appended to legitimate config file postcss.config.mjs, blockchain dead-drop C2, XOR-decrypted second-stage Beavertail loader. Likely an evasion response to the published rmcej_otb_payload YARA rule. Malicious payload found in: postcss.config.mjs Signature marker: Cot%3t=shtP (rotated variant — replaces rmcej%otb%) Obfuscator constants: shuffle seed 1111436, secondary seed 3896884, function name MDy Injection markers: global['_V'] = '8-974'; global['r'] = require; followed by IIFE shuffle-cipher Behavior: Obfuscated JavaScript appended to legitimate config file (postcss.config.mjs) after the original module export. Multi-layer string-shuffling deobfuscator that ultimately fetches an encrypted second-stage payload from a blockchain (TRON/Aptos/BSC) dead-drop, XOR-decrypts it, and eval()s it. Same architecture as the rmcej%otb% PolinRider variant, with all unique constants rotated — likely an evasion response to the published YARA rule.