GCVE-110-OSM-2026-14273

This is a legitimate repository that was compromised twice, by two unrelated campaigns. PolinRider (DPRK) came first: a force-push rewrote the history of the main branch so that a blockchain-based loader was hidden in `vite.config.js`, with the commit dates kept to look like the original commit. GhostAction came later: it added workflows that contain its server address, and a credential stealer disguised as a font file that starts through a hidden VS Code task and sets up a scheduled job that runs commands from the attacker's server every five minutes. Anyone who ran a build or dev server in the project after the PolinRider push should treat that machine as exposed to remotely delivered code, and anyone who opened it in VS Code with automatic tasks allowed after the GhostAction font was added should treat that machine's credentials as compromised. # PolinRider payloads Every PolinRider change was force-pushed by a helper script, `temp_auto_push.bat`, that copies the previous commit's author, date and message, amends the commit and force-pushes the branch, so each rewritten commit looks as old as the one it replaced. The repository's `.gitignore` is changed to hide the names of that script and its companion files. ## Payload 1: loader hidden in a build configuration file Malicious payload found in: `vite.config.js` JavaScript appended to the last line of the file after a run of about 1,690 spaces, with a `createRequire` import added at the top. This is the older TRON and Aptos loader. It starts from a hard-coded TRON wallet, reads its newest outgoing transaction, and uses a hidden note in it as the id of a BNB Smart Chain transaction whose data field holds the next stage. If TRON cannot be reached it falls back to an Aptos account. The next stage is decoded with a built-in key and run, once in the current process and once in a hidden `node` process. ## Payload 2: ignore-list fingerprint Malicious payload found in: `.gitignore` Three lines were added that hide the helper script and its companion files from `git status`. # GhostAction payloads ## Payload 3: workflows Malicious payload found in: `.github/workflows/github_actions_security.yml`, `.github/workflows/lint.yml` and `.github/workflows/repo-health.yml` Every version contains the GhostAction server address 193[.]32[.]204[.]199. `lint.yml` also carries the batch tag `c=auto_`, and `github_actions_security.yml` carries the markers of the 2025 GhostAction workflow (`Github Actions Security`, `send-secrets`, `Prepare Cache Busting`). Four commits titled "Trigger security scan" append a comment to `README.md` to start that workflow. ## Payload 4: credential stealer disguised as a font file Malicious payload found in: `public/fonts/fa-solid-400.woff2` Despite the `.woff2` extension this is a short, unobfuscated Node.js script. When run it reads the first 3,000 bytes of `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials`, `~/.netrc`, `~/.claude/.credentials.json`, `~/.gemini/oauth_creds.json` and `~/.kube/config`, and the SSH private keys `id_rsa` and `id_ed25519` in full. It runs a recursive `grep` of the home directory for AWS, Anthropic, GitHub, npm and PyPI token patterns and collects environment variables whose names begin with `AWS_`, `ANTHROPIC`, `OPENAI`, `HF_TOKEN`, `GITHUB_TOKEN`, `_API_KEY` or `_TOKEN`. Everything is sent with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080, with a batch tag in the query string. It then installs a crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server at a path keyed by the machine's hostname and pipes it to `bash`, which gives the operator remote command execution. The file does nothing on its own: it runs when the VS Code task below, or `node`, executes it. ## Payload 5: VS Code launcher Malicious payload found in: `.vscode/tasks.json` Defines a hidden shell task labelled `eslint-check` that runs `node ./public/fonts/fa-solid-400.woff2` with its output suppressed. It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code. The task sends nothing and installs nothing itself.