GCVE-110-OSM-2026-13725

Fake job-interview lure (Contagious Interview / PolinRider-style). Delivered via LinkedIn recruiter "Renata Rebelo" on 2026-10-15: offered a paid crypto-platform dev role, invited the target to the GitHub org logicloop-coin, and asked them to "check the project running". The repo is a Lovable/Vite/React/shadcn template with a hidden loader in vite.config.ts line 22: after the closing "}));" there are 635 tab characters pushing obfuscated JS off-screen. It executes whenever Vite loads its config (npm run dev / build / preview). No install hooks; package-lock resolves only to registry.npmjs.org. Impact: arbitrary remote code execution on the developer's machine with full Node.js access. Loader (decoded statically): sets global.o='5-goldy' (campaign tag); no-ops all console methods; exposes require/module/__dirname/__filename on global; anti-rerun guard global._p_t (30s). Builds code via Function constructor through 3 layers (string-shuffle cipher, dictionary decompressor, second shuffle table). Stage resolution: eth_blockNumber, then scans Ethereum blocks near (head>>8<<8)+5 via eth_getBlockByNumber on ethereum-rpc.publicnode.com, eth.drpc.org, eth-mainnet.public.blastapi.io, rpc.mevblocker.io for a tx whose "from" contains 596dcc9fda875309ff85eba09cf5a97d. That tx's "to" encodes a BSC block (hex chars 2-10) and tx index (chars 10-12). Fetches that BSC block from bsc-dataseed.binance.org / bsc-rpc.publicnode.com, hex-decodes the tx input, splits on "?.?", XOR-decrypts with key "8l%Sljl>J>U61O,n", and eval()s the result. Stored in global.ix. Differs from published PolinRider IOCs: new Ethereum resolution step, new XOR key, new tag. Next stage not retrieved; the cluster's known next stage is BeaverTail (infostealer/backdoor). vite.config.ts SHA-256: c08a4df1fe51ea53652bf17bdbe0cd13fe94617701973b2f7b7c827759b21a14 ZIP SHA-256: ce4caa69588ae56ebe9f5ce01f617969f00a92aaab305c523e78609c9f184921