GCVE-110-OSM-2026-14332

This repository, a fork of a public PHP package, was compromised twice, by two unrelated campaigns. PolinRider (DPRK) came first and was refreshed repeatedly: through a series of force-pushes on both branches it was given a hidden VS Code task that runs a fake font file containing a blockchain-based loader, which fetches code from an attacker server whose address is stored on a blockchain and runs it. GhostAction later added workflows that contain its server address. Two of the PolinRider force-pushes amended commits that carried GhostAction workflows. Anyone who opened the project in VS Code with automatic tasks allowed should treat that machine as exposed to remotely delivered code and its credentials as compromised. # PolinRider payloads Every PolinRider change was force-pushed by a helper script, `temp_auto_push.bat`, that copies the previous commit's author, date and message, amends the commit and force-pushes the branch, so each rewritten commit looks as old as the one it replaced. The repository's `.gitignore` is changed to hide the names of that script and its companion files. The helper script itself is committed in this repository. Both branches (`master` and `1.0.0`) carry the same files. ## Payload 1: VS Code launcher Malicious payload found in: `.vscode/tasks.json` A hidden VS Code task named `eslint-check` that runs automatically when the folder is opened, with its output suppressed. It starts `node` on a font-named file, and a missing `node` produces no error. Several versions were pushed. The current one is a short form that calls `node` directly on `public/fonts/fa-solid-300.ttf`. The earliest version was different: a task that downloads a shell script from a Vercel-hosted address and pipes it straight into the shell. The repository does not show what that script did. ## Payload 2: fake font files Malicious payload found in: `public/fonts/fa-solid-300.ttf` (current launcher target), `public/fonts/fa-solid.lkf` (still in the tree, no longer started) and several earlier `fa-solid-400.woff2` and `fa-solid-500.woff2` versions that were later removed The first generation is the older TRON and Aptos loader. It starts from a hard-coded TRON wallet, reads its newest outgoing transaction, and uses a hidden note in it as the id of a BNB Smart Chain transaction whose data field holds the next stage. If TRON cannot be reached it falls back to an Aptos account. The next stage is decoded with a built-in key and run, once in the current process and once in a hidden `node` process. Later generations are the Ethereum loader. It reads the newest transaction sent by a hard-coded Ethereum wallet to learn two server addresses, requests code from the first one over plain HTTP on port 443 with a marker in a `Sec-V` request header, decodes each answer with a built-in key and runs it as JavaScript in a hidden `node` process. The server addresses are stored on the blockchain, not in the file, so the operator can change them at any time. The newest files add a second wallet and an extra layer of obfuscation. ## Payload 3: helper script Malicious payload found in: `temp_auto_push.bat` A Windows batch script. It reads the author, e-mail, date and message of the latest commit, sets the machine clock and local git identity to those values, amends the commit with every working-tree change, restores the clock and force-pushes the branch with hooks disabled. ## Payload 4: ignore-list fingerprint Malicious payload found in: `.gitignore` Hides the helper script and its companion files from `git status`; it grew by one name at a time over successive versions. # GhostAction payloads Malicious payload found in: `.github/workflows/security-audit.yml`, `.github/workflows/build-check.yml`, `.github/workflows/audit.yml`, `.github/workflows/lint.yml` and `.github/workflows/code-review.yml` Every version contains the GhostAction server address 193[.]32[.]204[.]199. `build-check.yml` carries the batch tag `c=auto_` and `audit.yml` carries `c=reinject`. No GhostAction fake font was found in this repository.