GCVE-110-OSM-2026-12372

This repository belongs to the nestjsx GitHub organization, a victim whose repositories were compromised as part of the DPRK PolinRider campaign. Malicious .vscode/tasks.json files and disguised payload files were force-pushed onto multiple branches in each affected repository in automated, seconds-long bursts. Delivery: .vscode/tasks.json defines a hidden task labeled eslint-check (hide: true, runOn: folderOpen). VS Code auto-executes it the moment the folder is opened, with no user action required. It runs node ./public/fonts/fa-solid-500.woff2 — executing the file as obfuscated Node.js JavaScript despite its .woff2 extension. Payload file: public/fonts/fa-solid-500.woff2 — fails the WOFF2 magic-byte check and is tracked in Git as a text diff rather than a binary file, unlike the genuine font files bundled alongside it as decoy padding. fa-solid-500 is not a real Font Awesome weight (the library ships only 400 and 900), a secondary authenticity tell. C2 (NullReceiver): monitors Ethereum wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a for outbound transactions and decodes recipient address bytes to resolve the current C2 IP. Same wallet and technique confirmed across the broader PolinRider campaign (dom3691, AnwarBlockChain, lahirulhr/Visanduma intrusions).