GCVE-110-OSM-2026-11727

GitHub repository belonging to victim account `AnwarBlockChain`, a developer whose account has been compromised and whose public repositories have been poisoned with a malicious `.vscode/tasks.json` as part of the DPRK PolinRider campaign. The task is disguised as a routine `eslint-check`, hidden from the VS Code UI, and auto-executes the moment a victim opens the repository in VS Code. It runs a file at `public/fonts/fa-solid-400.woff2` — disguised as a Font Awesome asset but containing obfuscated Node.js JavaScript — silently and without any user action beyond opening the project. **Delivery:** `.vscode/tasks.json` with `runOn: folderOpen`, `hide: true`, label `eslint-check`. Executes `node ./public/fonts/fa-solid-400.woff2` on both Unix and Windows (dual `command -v node` / `where node` detection). **Payload file:** `public/fonts/fa-solid-400.woff2` — fails WOFF2 magic-byte check; plain UTF-8 obfuscated JavaScript (custom keyed-permutation cipher — different obfuscation toolchain from Variants A/B). SHA-256: `13e9a3c41e038bf9d8fcb0831305819819e4f7f4452bc20a04b9bf2756ee22e8`. Build marker: `global['!']='10-010'`. Same loader-shim pattern (`global['r']=require`, `global['m']=module`) and dual eval+detached-spawn persistence as Variants A/B — confirms same actor, parallel build. **C2 (NullReceiver, multi-chain variant):** dead-drop resolved via TRON (`api.trongrid.io`), with Aptos (`fullnode.mainnet.aptoslabs.com`) as fallback. Actual payload bytes retrieved via BSC JSON-RPC (`bsc-dataseed.binance.org` / `bsc-rpc.publicnode.com` fallback). **Dead-drop wallets:** TRON primary `TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP` (XOR key: `2[gWfGj;<:-93Z^C`), TRON secondary `TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG` (XOR key: `m6:tTh^D)cBz?NM]`).