GCVE-110-OSM-2026-12390

PolinRider malware injected via at least 4 separate open PRs (from 4 different contributor accounts) into nomeyy/dev-test config files - consistent with a shared tutorial/bootcamp template being widely compromised, each student independently reintroducing the payload. === UPSTREAM INJECTION ATTEMPT (MULTIPLE OPEN PRs, MULTIPLE AUTHORS) === Repo: nomeyy/dev-test Infected files: postcss.config.js, next.config.js Signature: v3-style global.i="A9-/A10-..." markers and plain global['i'], global['m']/global['r'] require/module hijack (varies slightly per PR/author) === PR STATUS === PR #115 (navshbk): OPEN, payload confirmed PR #71 (mytechworker): OPEN, payload confirmed PR #76 (Junaid522): OPEN, payload confirmed PR #98 (netsetsoftware-git): OPEN, payload confirmed PR #117 (discussionforall): checked, no payload found in this one All to the same target repo nomeyy/dev-test from 4 different external accounts - suggests a widely-distributed compromised dependency/template used by multiple independent developers, not a single attacker.