GCVE-110-OSM-2025-314

PolinRider victim repository - compromised developer account with obfuscated JavaScript payload in postcss.config.mjs. Part of DPRK-attributed supply-chain campaign targeting developer environments. This is a Category A finding (victim's own repo) rather than upstream injection. Malicious payload found in: postcss.config.mjs PolinRider signature: global['!']='9-900';var _$_1e42= Obfuscation seed: ("rmcej%otb%",2857687) Attack vector: Obfuscated JavaScript appended to PostCSS config file. The payload uses characteristic PolinRider string deobfuscation with seed 'rmcej%otb%' to decode embedded C2 commands that execute when the config file is loaded during build processes. Behavior: Connects to attacker-controlled C2 infrastructure for cryptocurrency theft and credential exfiltration. Executes via Node.js during npm/yarn build processes.