security: eradicate PolinRider malware indicators and harden CODEOWNERS

[Mystery-CLI]

Security Incident Remediation: PolinRider Campaign Cleanup

Overview

Following notification of potential compromise via the PolinRider supply-chain malware campaign, an exhaustive audit of the repository was performed.

Findings

• Vector & Root Cause: Traced to Pull Request Feat/drifting #1186 (\codesailor4/feat/drifting), merged on August 26, 2026. A contributor's infected environment silently appended an obfuscated JavaScript payload preceded by extensive whitespace to the last line of JavaScript/Node files in their workspace.
• Payload Signature: \global.o='5-1485-du';var _=(function...\
• Affected Files (11 files):
  1. \�ackend/prisma/seed.js\
  2. \�ackend/src/server.js\
  3. \rontend/.storybook/vite.config.js\
  4. \rontend/vite.config.js\
  5. \mutation-reports/tracker.js\
  6. \scripts/check-i18n-strings.mjs\
  7. \scripts/cleanup-test-artifacts.mjs\
  8. \scripts/pii-scan.mjs\
  9. \security/secrets-scanner.js\
  10. \security/zap-scanner.js\
  11. \ est-environments/cli.js\

Changes Made

1. Malware Removal: Completely stripped the trailing whitespace and malicious obfuscated script from all 11 files, restoring clean endings.
2. Repository Scan: Verified 0 occurrences of known code markers (
   mcej%otb%, \Cot%3t=shtP, _, \global['_V'], \global.o=, \5-1485-du), malicious font files (\a-solid-*), batch files (\ emp_auto_push.bat, \config.bat), or unauthorized .vscode/tasks.json\ entries.
3. Preventive Hardening: Updated .github/CODEOWNERS\ with explicit review requirements for .vscode/, .devcontainer/, \package.json, binary/font files, and configuration files.
4. Access Audit: Confirmed 0 unauthorized webhooks, 0 deploy keys, and no unauthorized collaborators.