GCVE-110-OSM-2026-12343

PolinRider malware (v3 variant: javascript-obfuscator.io hex/opcode packing, Ethereum JSON-RPC C2) injected via an ACTIVE OPEN PR (#268) into eslint.config.js of kinde-oss/js-utils, a Kinde auth-as-a-service utility package. The PR is disguised with an innocuous, plausible title unrelated to the payload, submitted by an account with direct push access to a branch in the org repo (not an external fork) - consistent with a compromised collaborator account. === UPSTREAM INJECTION ATTEMPT (ACTIVE OPEN PR) === Attack type: Compromised-collaborator PR injection (branch within the org repo, not a separate fork) Target repo: kinde-oss/js-utils Author: dtoxvanilla1991 (Yuri Avdijevski) PR created: 2026-08-21 === PAYLOAD === Infected file: eslint.config.js Signature: PolinRider v3-style payload - javascript-obfuscator.io hex/opcode string array packing, global['r']=require;global['m']=module hijack, global['_V']=global['i'] marker assignment, Ethereum JSON-RPC calls (eth_blockNumber-style) used as blockchain dead-drop C2, spawn('node',['-e',...]) + eval() execution. Disguised PR title: "fix: only send credentials on cookie-based token refresh" (legitimate-sounding, unrelated to actual diff content) === PR STATUS === PR #268 to kinde-oss/js-utils: OPEN since 2026-08-21, still open as of 2026-09-18 Parent infected: No (near miss, but PR is live and mergeable at any time)