GCVE-110-OSM-2026-11734

GitHub repository belonging to victim account `dom3691`, a developer whose account has been compromised and whose public repositories have been poisoned with a malicious `.vscode/tasks.json` as part of the DPRK PolinRider campaign. The task is disguised as a routine `eslint-check`, hidden from the VS Code UI, and auto-executes the moment a victim opens the repository in VS Code. It runs a file at `public/fonts/fa-solid-400.woff2` — disguised as a Font Awesome asset but containing obfuscated Node.js JavaScript — silently and without any user action beyond opening the project. **Delivery:** `.vscode/tasks.json` with `runOn: folderOpen`, `hide: true`, label `eslint-check`. Executes `node ./public/fonts/fa-solid-400.woff2` on both Unix and Windows (dual `command -v node` / `where node` detection). **Payload file:** `public/fonts/fa-solid-400.woff2` — fails WOFF2 magic-byte check; plain UTF-8 obfuscated JavaScript (javascript-obfuscator, hex-array/`_0x` style). SHA-256: `3e4e79b5396813f4e95fc4d9d017e30fb5a954372a3065ac999f843847834013`. Build marker: `global.i="A8-new*#"`. **C2 (NullReceiver):** monitors Ethereum wallet `0xa322e5f3d311d3080e6f0121063e9adc2490ef1a` for its most recent outbound transaction; decodes first 4 bytes of the `to` address as C2 IP #1, next 4 bytes as C2 IP #2. Fetches next-stage payload from `http://<IP>:443/0x/cls` (XOR key: `q4FZkxX{!h,Sr3=@`) and `http://<IP>:443/0x/ls` (XOR key: `y-p_>d$0B&@^1aQk`), reading from custom `X-Payload-B64` response header. Decrypted payload is `eval()`'d in-process and passed to a detached hidden `node -e` child process (`detached: true`, `stdio: 'ignore'`, `.unref()`) for independent persistence. Trailing dead-drop bytes decode to ASCII `helloipbot!!`. **Active C2 IPs:** `193.247.144.38` (2026-09-04+), `166.88.73.46` (2026-08-31 through 2026-09-03).