GCVE-110-OSM-2026-1760

Repository compromised by the PolinRider DPRK threat actor (Lazarus, Contagious Interview cluster). Obfuscated JavaScript payload bearing the unique rmcej%otb% signature has been appended to the legitimate config file apps/frontend/postcss.config.mjs, characteristic of the PolinRider supply-chain campaign that injects malicious code via a compromised npm package (e.g. tailwind-mainanimation/tailwind-autoanimation). Payload uses blockchain (TRON/Aptos/BSC) as a dead-drop C2 to fetch and execute encrypted second-stage Beavertail loader. Malicious payload found in: apps/frontend/postcss.config.mjs Signature marker: rmcej%otb% Obfuscator: PolinRider 4-layer shuffle-cipher with seed 2857687, function _$_1e42 Behavior: Obfuscated JavaScript appended to legitimate config file. Performs blockchain dead-drop C2 via TRON (TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP) and Aptos fallback, XOR-decrypts retrieved payload with key "2[gWfGj;<:-93Z^C", and eval()s a multi-stage Beavertail loader. Spawns detached child process for persistence.