GCVE-110-OSM-2025-301

PolinRider threat actor obfuscated JavaScript payload injected into postcss.config.mjs. Uses distinctive 'rmcej%otb%' signature to deobfuscate C2 code at runtime. Campaign linked to DPRK-attributed supply-chain injection via compromised forks and malicious PRs. Malicious payload found in: postcss.config.mjs Obfuscation signature: rmcej%otb% (PolinRider threat actor) Attack vector: Obfuscated JavaScript appended to config/route file. Uses sfL() string-scramble decoder with seed 'rmcej%otb%' to deobfuscate an embedded C2 payload that executes when the file is loaded (via require/import). Behavior: Connects to attacker-controlled C2, typically for cryptocurrency theft and credential exfiltration. Matches DPRK-linked PolinRider campaign targeting developer environments via compromised forks/PRs.