GCVE-110-OSM-2026-13742

This is a legitimate NPM package who's maintainer was compromised as part of the PolinRider ongoing attack. The threat actor published one known malicious version 16.1.2. All other versions are benign. ENTRY lib/component.jsx (main: ./lib/component.jsx) PAYLOAD webpack.config.js - this is the file that had the PolinRider payload appended to it. DESTINATION - 2 exfil (bitcoinAddresses, ethereumAddresses) (values recorded in verified_iocs)