Tanvir-Alam625/Online-Bank-Of-BD-client

PolinRider-infected GitHub repository. Delivery via a malicious .vscode/tasks.json that stages the fa-solid-400.woff2 payload dropper. DPRK-linked per the detection source (medium confidence; new attribution not previously on the campaign). Campaign code signatures rmcej%otb% / Cot%3t=shtP, XOR keys, and Tron wallet addresses appear in this delivery pattern. Automated monitor hit; infected .vscode/tasks.json last modified 2026-09-12T18:10:41Z. Part of the Tanvir-Alam625 single-actor spray: 10 repos sprayed with the same tasks.json payload in tight time windows.