GCVE-110-OSM-2026-11728

GitHub repository belonging to victim account `AnwarBlockChain`, a developer whose account has been compromised and whose public repositories have been poisoned with a malicious `.vscode/tasks.json` as part of the DPRK PolinRider campaign. The task is disguised as a routine `eslint-check`, hidden from the VS Code UI, and auto-executes the moment a victim opens the repository in VS Code. It runs a file at `public/fonts/fa-solid-400.woff2` — disguised as a Font Awesome asset but containing obfuscated Node.js JavaScript — silently and without any user action beyond opening the project. **Delivery:** `.vscode/tasks.json` with `runOn: folderOpen`, `hide: true`, label `eslint-check`. Executes `node ./public/fonts/fa-solid-400.woff2` on both Unix and Windows (dual `command -v node` / `where node` detection). **Payload file:** `public/fonts/fa-solid-400.woff2` — fails WOFF2 magic-byte check; plain UTF-8 obfuscated JavaScript (javascript-obfuscator, hex-array/`_0x` style). SHA-256: `c98f2703db7e8b73b296e686cc8dee89d1b1643a90c3e89ef90b6a75805421aa`. Build marker: `global.i="A10-*020"`. **C2 (NullReceiver):** same mechanism as Variant A — monitors Ethereum wallet `0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`. Same C2 endpoints, XOR keys, and `X-Payload-B64` header. Trailing dead-drop bytes decode to ASCII `helloipbot!!`. **Self-deletion:** after execution, Variant B reads its own file, strips the malicious block, and rewrites the cleaned file to disk — anti-forensics to reduce post-execution footprint. **Active C2 IPs:** `193.247.144.38` (2026-09-04+), `166.88.73.46` (2026-08-31 through 2026-09-03).