GCVE-110-OSM-2025-226

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload bearing the unique rmcej%otb% signature has been appended to src/Student.js, characteristic of the PolinRider supply-chain campaign that injects malicious code via a compromised npm package (e.g. tailwind-mainanimation/tailwind-autoanimation). Payload uses a 4-layer shuffle-cipher (seed 2857687, decoder _$_1e42) culminating in a blockchain dead-drop C2 (TRON/Aptos/BSC) that fetches and eval()s an XOR-encrypted Beavertail second-stage loader. Malicious payload found in: src/Student.js Signature marker: rmcej%otb% Obfuscator: PolinRider 4-layer shuffle-cipher with seed 2857687, function _$_1e42 Detected markers: rmcej%otb%,_$_1e42,global['!'] Behavior: Obfuscated JavaScript appended to legitimate config file. Performs blockchain dead-drop C2 via TRON (TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) and Aptos fallback, XOR-decrypts retrieved payload with key '2[gWfGj;<:-93Z^C', and eval()s a multi-stage Beavertail loader.