GCVE-110-OSM-2026-11144

PolinRider (DPRK Contagious Interview) backdoor tagged with OSM campaign marker A9-8044. Obfuscated JavaScript payload injected into postcss.config.mjs; canonical config-file tail injection (typically postcss.config.mjs, eslint.config.mjs, or similar). Malicious payload found in: postcss.config.mjs Injection pattern: global.i="A9-8044" appears in a `global` assignment carrying the OSM campaign marker A9-8044, followed by a `_0x`-prefixed obfuscated function-name array. This is the canonical TTP for this campaign: shuffle-cipher-obfuscated stage-1 that decodes at runtime and reaches out to a blockchain dead-drop C2 (TRON / Aptos / BSC) to fetch the next stage. Unconfirmed indicators: - Decoded C2 endpoint not enumerated in this submission — payload left in encoded form; per-repo dynamic analysis is needed to confirm the specific drop chain used by this variant.