GCVE-110-OSM-2026-13206

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Contains a hidden VS Code autorun task that executes a JavaScript payload disguised as a Font Awesome webfont file. Malicious payload found in: .vscode/tasks.json Hidden task labeled 'eslint-check', configured with runOn:"folderOpen" and hide:true/reveal:"never" so it auto-executes with no visible UI the instant the folder is opened in VS Code. The task runs a Node.js command against a file with a .woff2/.woff/.ttf/.eot extension that is not a real font; it is obfuscated JavaScript (confirmed via static analysis in related samples: plain-text content opening with a global.i/global['!'] campaign marker, javascript-obfuscator-style hex array obfuscation, blockchain-dead-drop C2 resolution, and a child_process require for remote command execution).