Fake PoC, Real Backdoor: How a Typosquatted Repo Weaponized CVE-2026-31431

.prose h1, .prose h2, .prose h3, .prose h4, .prose h5, .prose h6 { color: #4fd1c5; /* text-teal-400 */ font-weight: 700; /* font-bold */ margin-bottom: 0.5rem; } .prose h1 { font-size: 2.25rem; /* text-4xl */ line-height: 2.5rem; } .prose h2 { font-size: 1.875rem; /* text-3xl */ line-height: 2.25rem; } .prose h3 { font-size: 1.5rem; /* text-2xl */ line-height: 2rem; } .prose p { margin-bottom: 1rem; color: #d1d5db; /* text-gray-300 */ } .prose a { color: #4fd1c5; /* text-teal-400 */ text-decoration: underline; } .prose a:hover { color: #99f6e4; /* lighter teal for hover */ } .prose ul { list-style-type: disc; padding-left: 1.5rem; margin-bottom: 1rem; color: #d1d5db; /* text-gray-300 */ } .prose ol { list-style-type: decimal; padding-left: 1.5rem; margin-bottom: 1rem; color: #d1d5db; /*…

Excerpt limited to ~120 words for fair-use compliance. The full article is at Ip-ninja.