GCVE-110-OSM-2026-14022

Repository infected with the PolinRider malware campaign. A file named like a web font in the repository is not a real font. It contains an obfuscated JavaScript payload matching the PolinRider signature. Running, building or forking the project may execute the payload on the developer's machine. Malicious payload found in: `public/fonts/fa-solid-400.woff2` - Detection: the file contains the PolinRider loader signature, a global-scope `require` alias followed by a `typeof module` check against an obfuscated string-table lookup. Confirmed by a regex match against the raw file at the commit in the evidence link. - Disguise: the file is 5102 bytes and carries a .woff2 extension, but a genuine Font Awesome solid font is a much larger binary file. - Vector: the repository also contains `.vscode/tasks.json`, the VS Code task file associated with this campaign's execution on folder open. Its contents were not examined for this report. - Not determined: the payload was not decoded in this report, so the second stage and C2 are not enumerated.