GCVE-110-OSM-2026-11229

PolinRider (DPRK Contagious Interview) backdoor tagged with OSM campaign marker 10-010. Obfuscated JavaScript payload injected into public/fonts/fa-solid-400.woff2; fake-font variant: JS payload smuggled inside what looks like a WOFF2 font file. Malicious payload found in: public/fonts/fa-solid-400.woff2 Injection pattern: global.i="10-010" appears in a `global` assignment carrying the OSM campaign marker 10-010, followed by a `_0x`-prefixed obfuscated function-name array. This is the canonical TTP for this campaign: shuffle-cipher-obfuscated stage-1 that decodes at runtime and reaches out to a blockchain dead-drop C2 (TRON / Aptos / BSC) to fetch the next stage. Unconfirmed indicators: - Decoded C2 endpoint not enumerated in this submission — payload left in encoded form; per-repo dynamic analysis is needed to confirm the specific drop chain used by this variant.