An attacker using a BindsNET collaborator's credentials hid a malicious Visual Studio Code folder-open task inside a forged merge commit and force-pushed it across 20 branches. A routine Dependabot merge later carried the injected files into the master branch, causing an obfuscated JavaScript loader disguised as a font to execute when affected clones were opened in VS Code-compatible editors. The loader used an Ethereum wallet to discover rotating command servers and fetched an unrecoverable second stage from cleartext HTTP endpoints on port 443. The source identifies the compromise as PolinRider, a North Korean supply-chain campaign linked to the Contagious Interview and Famous Chollima activity clusters.