GCVE-110-OSM-2026-10241

This is a confirmed supply-chain compromise of a legitimate package. APT malware detected: PolinRider, nullreceiver. Associated with threat actor(s): DPRK/Lazarus. Behaviours: data exfiltration, code execution, network activity, obfuscated code, install-time execution. ENTRY scripts/patch-fsbrowse.js (install-hook: node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in test-integration.js: ".bashrc" DESTINATION - 24 exfil (custom-c2, reconstructed, ethereumAddresses) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in lib/http-handler.js: "process.env.CORS_ORIGIN === '*' && !process.env.PASSWORD) { console.warn('[agent..." - Reverse Shell in lib/terminal.js: "pty.spawn(" - Environment Variable Exfiltration in scripts/validate-mutations.mjs: "process.env.PASSWORD } : {}; const J = { 'Content-Type': 'application/json', ......" - Sensitive File Access in test.js: "'/etc/passwd'" - Data Encoding for Exfiltration in lib/asset-server.js: "encodeURIComponent(window.__WS_TOKEN):'';const ws=new WebSocket((location.protoc..." - Data Encoding for Exfiltration in lib/http-handler.js: "encodeURIComponent(_pwd) + '; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400' + (..." - Data Encoding for Exfiltration in scripts/validate-mutations.mjs: "encodeURIComponent(ROOT) + '&name=.env', { method: 'PUT', headers: AUTH, body: '..." - Data Encoding for Exfiltration in site/app/js/app.js: "encodeURIComponent(tab" (+23 more) OBFUSCATION - Decoded Unicode Escape Content in database.js (x20) - IOCs Found in Deobfuscated Code in database.js - Trailing Code After Module Exports in database.js: "export default { queries }; g" - Whitespace-Padded Hidden Payload in database.js: "; global" - Dynamic Base64 Decoding in database.js: "Buffer.from(n,"base64")" - Dynamic Base64 Decoding in site/app/vendor/anentrypoint-design/247420.js: "atob(e)" - Obfuscation (osm-deobfuscator): NiceGUI Multi-layer Obfuscation in database.js - Unicode Escape Obfuscation in database.js: "\u0068\u0074\u0074\u0070\u0073" (+4 more) ADDITIONAL FINDINGS - Global Require Alias in database.js: "global['r']=require" - Reconstructed Obfuscated URL in site/app/vendor/anentrypoint-design/247420.js: "https://cdn.jsdelivr.net/npm/prismjs@1.30.0/components/prism-core.min.js" - Campaign marker: PolinRider in database.js: "global['_V']" - Campaign marker: nullreceiver in [deobfuscated] database.js: "q4FZkxX{!h,Sr3=@" - Malicious Dependency Detected in package.json - Clipboard Access in .gm/prd.yml: "clipboard.writeText" (+6 more) PAYLOAD FILES database.js