Security: PolinRider malware detected in two open PRs (#7716, #10321)

Security: PolinRider malware detected in two open PRs (#7716, #10321) #11971

Description

Security Alert

PolinRider malware (DPRK-attributed, Lazarus/Contagious Interview cluster) has been detected in two independent open pull requests against this repository.

Affected PRs

PR #7716 ("[bug]: Calendar year, month dropdown height issue #7680") — submitted from shakin-shahria/ui

- Touches apps/v4/postcss.config.mjs,templates/monorepo-next/apps/web/postcss.config.mjs,templates/monorepo-next/packages/ui/postcss.config.mjs, plus severaltailwind.config.jstest fixtures

- Payload verified present in the diff (obfuscated code appended after the legitimate config content)

PR #10321 ("feat: Image upload component") — submitted from stefann01/ui

- Touches apps/v4/postcss.config.mjsand multiplepostcss.config.mjs/tailwind.config.jsfiles across templates and test fixtures

- Payload verified present in the diff

Indicators

- Marker: global.i="A#-..."(e.g.A9-3443-2) — a payload variant using javascript-obfuscator.io-style hex/opcode packing, internally remapped to aglobal['_V']reference

- Execution via eval/spawn, C2 over rotating public Ethereum JSON-RPC endpoints

- Appended after otherwise-legitimate config content, easy to miss in a large diff

Remediation

- Do not merge PR [bug]: Calendar year, month dropdown height issue #7680 #7716 or feat: Image upload component #10321 as-is

- Strip the postcss/tailwind config changes from both PRs before considering any legitimate portions

- Reach out to both account owners (shakin-shahria,stefann01) to check for compromise — this is consistent with account takeover, not necessarily malicious intent from the original account owner

References

- https://opensourcemalware.com

- Reported via automated threat hunting