GCVE-110-OSM-2026-1712

This repo contains obfuscated javascript malware embedded in existing code. One notable attribute is that the infected repository at minimum has approximately 100+ stars. The malware payload exhibits same signature of previously reported Neutralinojs compromise. Each obfuscated malware has a global flag. One of the unique strings in the payload is " Cot%3t=shtP" The deobfuscated script contained following Aptos and Tron wallet addresses that matches PolinRider campaign reported by OSM TRON addr TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG Aptos hash 0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3 TRON addr TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Aptos hash 0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e