GCVE-110-OSM-2026-14116

Threat actor repository posing as a developer job assessment for an NFT e-commerce platform. It is a lure used in DPRK Contagious Interview style social engineering, where a targeted developer is asked to clone, run or review the project as part of a fake hiring process. A developer who consumes the repository can be infected with a DPRK payload that includes PolinRider. NFT and e-commerce themes are aimed at cryptocurrency and web3 developers. Malicious payload found in: `frontend/public/images/splash.png` - Detection: the file contains the PolinRider loader signature, a global-scope `require` alias followed by a `typeof module` check against an obfuscated string-table lookup. Confirmed by a regex match against the raw file at the commit in the evidence link. - Disguise: the file carries a .png extension but contains text JavaScript (4600 bytes), unlike the fake-font and config-file placements usually seen with PolinRider. - Delivery: the payload was added in the repository's second commit, shortly after the initial commit. - Not determined: the payload was not decoded in this report, so the second stage and C2 are not enumerated.