Attackers used compromised collaborator credentials to force-push a forged merge commit across 20 BindsNET branches, eventually introducing it into `master` through a routine Dependabot merge. A hidden Visual Studio Code task automatically ran obfuscated JavaScript disguised as a font whenever an affected repository folder was opened with Node.js available. The script retrieved a runtime second stage through Ethereum JSON-RPC endpoints and launched it as a detached process, a technique the advisory says matches the documented PolinRider pattern. The maintainers removed the injected files, restored the overwritten branches, restricted the compromised account, and enabled stronger branch protections.