GCVE-110-OSM-2026-14333

This repository, a fork of a small public sample project, was compromised twice, by two unrelated campaigns. PolinRider (DPRK) came first: a rewritten merge commit added a hidden VS Code task that runs a fake font file containing a blockchain-based loader, which fetches code from an attacker server whose address is stored on a blockchain and runs it. GhostAction came later and added workflows that contain its server address. Anyone who opened the project in VS Code with automatic tasks allowed since the first PolinRider push should treat that machine as exposed to remotely delivered code and its credentials as compromised. # PolinRider payloads Every PolinRider change was force-pushed by a helper script, `temp_auto_push.bat`, that copies the previous commit's author, date and message, amends the commit and force-pushes the branch, so each rewritten commit looks as old as the one it replaced. The repository's `.gitignore` is changed to hide the names of that script and its companion files. Both fake fonts were added inside rewritten merge commits titled "Merge pull request #22", which do not show in a normal per-commit diff. ## Payload 1: VS Code launcher Malicious payload found in: `.vscode/tasks.json` A hidden VS Code task named `eslint-check` that runs automatically when the folder is opened, with its output suppressed. It starts `node` on a font-named file, and a missing `node` produces no error. Two versions: the current one runs `public/fonts/fa-solid-500.woff2`, the earlier one ran `public/fonts/fa-solid-400.woff2`. ## Payload 2: fake font files Malicious payload found in: `public/fonts/fa-solid-500.woff2` (current) and `public/fonts/fa-solid-400.woff2` (earlier, removed from the tree but still in the history) JavaScript stored in a file with a font extension after a long run of blank space, so it looks empty in a viewer. The hidden VS Code task runs it with `node`. It reads the newest transaction sent by a hard-coded Ethereum wallet to learn two server addresses, requests code from the first one over plain HTTP on port 443 with a marker in a `Sec-V` request header, decodes each answer with a built-in key and runs it as JavaScript in a hidden `node` process. The server addresses are stored on the blockchain, not in the file, so the operator can change them at any time. ## Payload 3: ignore-list fingerprint Malicious payload found in: `.gitignore` Hides the helper script and its companion files from `git status`. # GhostAction payloads Malicious payload found in: `.github/workflows/security-audit.yml` (two versions), `.github/workflows/ci-check.yml`, `.github/workflows/lint.yml` and `.github/workflows/audit.yml` Every version contains the GhostAction server address 193[.]32[.]204[.]199. The later `security-audit.yml` version carries the batch tag `c=auto_` and `ci-check.yml` carries `c=reinject`. No GhostAction fake font was found in this repository.