Syncraft Labs takes the security and integrity of our open-source software, ecosystem, and community with the utmost seriousness. This document outlines our security policies, vulnerability reporting process, and transparent post-mortem disclosures of historical security incidents.

We actively provide security patches and updates for the versions listed below.

If you discover a security vulnerability in any Syncraft Labs package or infrastructure, please report it responsibly so we can remediate the issue before public disclosure.

• GitHub Security Advisory (Preferred): Submit a private advisory report directly via GitHub Security Advisories.
• Direct Email: If GitHub Security Advisories is unavailable, contact the lead maintainer directly at denislistiadi24@gmail.com with the subject line [SECURITY] Syncraft Labs Vulnerability Report.

To help us investigate and triage quickly, please include:

1. Package name(s) and version(s) affected.
2. Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
3. Assessment of potential impact and exploit scenario.
4. Any proposed patches or mitigations (if available).

• Initial Acknowledgment: Within 24–48 hours of report receipt.
• Triage & Impact Assessment: Within 3–5 business days.
• Fix & Advisory Release: Coordinated fix and patch release timeline established based on severity.

We fully support responsible security researchers. We will not take legal action against individuals who discover and report vulnerabilities in good faith, provided that:

• You avoid privacy violations, data destruction, and service interruption.
• You do not exploit a vulnerability beyond what is strictly necessary to demonstrate proof-of-concept.
• You allow a reasonable timeframe for remediation before public disclosure.

• Date of Incident: August 22, 2026
• Severity: Critical (CVSS 9.8)
• Type: Unauthorized Package Compromise / Supply-Chain Malware Injection
• Threat Actor Campaign: PolinRider (also tracked under Contagious Interview campaign)
• Status: Resolved & Fully Remediated in v0.4.2

On August 22, 2026, version 0.4.1 of @syncraft-labs/core, @syncraft-labs/react, and @syncraft-labs/vue was released containing unauthorized malicious code injected by an external supply-chain attack campaign known as PolinRider.

No source code within the GitHub git repository branches was altered or compromised; the malicious payload was injected exclusively into the distributed build artifacts (dist/index.js) prior to NPM registry publication.

The compromise occurred as part of a targeted developer social engineering campaign (Contagious Interview / PolinRider):

1. Initial Vector: The maintainer's local development environment was infected after downloading and running a project workspace received during what appeared to be a technical freelance assessment.
2. Credential Theft: Background malware (PolinRider RAT payload) extracted local developer credentials, including a GitHub Personal Access Token (PAT) and NPM publishing session data.
3. Unauthorized Release: Using the harvested credentials, the attacker triggered an automated build-and-publish sequence for version 0.4.1 across all three packages (@syncraft-labs/core, @syncraft-labs/react, @syncraft-labs/vue).

The injected payload in version 0.4.1 exhibited the following characteristics:

• Evasion & Obfuscation: The malicious JavaScript code was appended inside dist/index.js separated by hundreds of empty whitespace lines (padding) to hide the snippet from immediate visual inspection, standard terminal previews, and quick file diffs.
• Payload Behavior:
  • Scanned local environment variables (looking for API keys, AWS/GCP/Azure cloud tokens, .env entries).
  • Attempted to enumerate developer credentials, SSH keys, git configurations, and cryptocurrency wallet browser extension storage.
  • Attempted to establish outbound command-and-control (C2) communication to exfiltrate collected data.

If your project or CI/CD pipeline installed or used version 0.4.1 of @syncraft-labs/core, @syncraft-labs/react, or @syncraft-labs/vue:

Ensure your package.json and lockfiles are updated to version 0.4.2 or later:

npm install @syncraft-labs/core@latest @syncraft-labs/react@latest @syncraft-labs/vue@latest
# or with yarn:
yarn upgrade @syncraft-labs/core @syncraft-labs/react @syncraft-labs/vue
# or with pnpm:
pnpm update @syncraft-labs/core @syncraft-labs/react @syncraft-labs/vue

# Clear NPM cache
npm cache clean --force

# Remove node_modules and reinstall
rm -rf node_modules package-lock.json
npm install

If version 0.4.1 was executed on a machine containing sensitive data or environment secrets:

• Rotate all API keys and environment variables (e.g., database credentials, service tokens, cloud provider keys) present on that machine.
• Rotate SSH keys, GitHub tokens, and NPM tokens.
• Check developer system configuration files (~/.bashrc, ~/.zshrc, ~/.profile) for unauthorized persistent entries.

To guarantee supply-chain integrity and prevent recurrence, the following infrastructure measures have been permanently implemented:

1. Mandatory Multi-Factor Authentication (2FA):
   • Enforced hardware WebAuthn / TOTP Two-Factor Authentication across all NPM maintainer accounts for every publish command (publishConfig.access with 2FA enforcement).
2. Automated CI/CD Provenance & Trusted Publishing:
   • Replaced static personal publish tokens with short-lived OIDC-based GitHub Actions Trusted Publishing, generating verifiable NPM build provenance attestations.
3. Build Artifact Integrity Diffing:
   • Added automated pre-publish verification pipelines that compare compiled output strictly against TypeScript source files, rejecting any uncommitted or extraneous code.
4. Environment Isolation Protocol:
   • Strict adherence to containerized/sandboxed virtual environments when testing or evaluating any third-party or untrusted external codebases.

Syncraft Labs is committed to complete transparency regarding security issues. We believe open communication and detailed post-mortems build a safer ecosystem for everyone.

For inquiries or follow-up regarding this advisory or our security posture, please reach out to denislistiadi24@gmail.com or open a GitHub Discussion.