GCVE-110-OSM-2026-9158

This package was compromised or published by the North Korean threat actor PolinRider. The tailwind.config.js file had a malicious JavaScript payload appended to it, or that file was added to the package. ENTRY dist/index.cjs (main: ./dist/index.cjs) DESTINATION - urls: https://quick-start-ai-backend.vercel.app/api/v1 (c2, plaintext) - domains: quick-start-ai-backend.vercel.app (c2, plaintext) EXFIL - Network Request in dist/index.js: "axios.post(" OBFUSCATION - Whitespace-Padded Hidden Payload in tailwind.config.js: "; global" - Obfuscation: function to array replacements in tailwind.config.js - Suspicious Global Assignment in tailwind.config.js: "global['!']=" - Deobfuscation Failed in tailwind.config.js - Obfuscation patterns: underscoreDollarVars, splitJoinChain in tailwind.config.js PAYLOAD FILES tailwind.config.js INDICATORS (IOCs) - domains: res.cloudinary.com - payloadFileHash: 15e3898720f6593c297340b730b587fde2ad64883c359cdf7dbd0f1c87488ac9