GCVE-110-OSM-2026-12392

PolinRider malware fork of onlook-dev/onlook (26,761 stars) with an ACTIVE OPEN pull request (#3109) carrying the payload into the upstream project via a disguised, plausible-sounding title unrelated to the payload. === UPSTREAM INJECTION ATTEMPT (ACTIVE OPEN PR) === Attack type: Fork-and-PR upstream injection Fork repo: Abdul-Moiz31/onlook Parent repo: onlook-dev/onlook (26,761 stars) === PAYLOAD === Infected files: apps/web/client/postcss.config.js, docs/postcss.config.mjs, packages/ui/postcss.config.js Signature: v3-style global.i="A9-..." marker + global['m']/global['r'] require/module hijack, hex-obfuscated payload Disguised PR title: "fix: stop firing protected tRPC queries on auth-optional surfaces" (legitimate-sounding, unrelated to actual diff content) === PR STATUS === PR #3109 to onlook-dev/onlook: OPEN since 2026-05-15, still open Parent infected: No (near miss, but PR is live and mergeable at any time)