security: remove PolinRider payload (supply chain attack)

[suhas-005]

Security Remediation — Merge Immediately

Attack: PolinRider DPRK supply-chain compromise. One or more config files were modified to include an obfuscated JS payload that runs on lint/build/npm install — steals env vars, AWS/gcloud tokens, SSH keys, browser sessions, and downloads a second-stage RAT.

This was missed by the May-15 incident cleanup because GitHub code search excludes files with single lines >4096 bytes (the obfuscated payload is one ~5000-char line, designed exactly to hit that exclusion). Detected by raw-content scan on 2026-05-19.

Markers found: rmcej, v1 seeds 2857687/2667686, global['!'] (PolinRider v1).

This PR restores the following infected files (ancestor = pulled clean from earlier git history; truncated = born-infected file, payload line stripped while preserving developer's intended content):

• docs/babel.config.js
• superset-embedded-sdk/babel.config.js

Action required for anyone who pulled this repo and ran npm install / lint / build: rotate AWS credentials, GitHub tokens, SSH keys, npm tokens, and any .env secrets immediately. Sign out of all browser sessions.

Refs

• OSM dossier: https://opensourcemalware.com/blog/polinrider-attack
• Technical writeup: https://github.com/OpenSourceMalware/PolinRider

⚠️ No review needed — squash-merge immediately.

[vulcanho]

📋 Summary

PR #4 correctly strips the identical PolinRider v1 obfuscated payload (global['!']='10-0150'; seeds 2857687/2667686) from docs/babel.config.js and superset-embedded-sdk/babel.config.js, completing the config-file remediation started in PRs #2 and #3. Both cleaned files are syntactically valid Babel configs. However: (1) the cleanup leaves a missing trailing newline that the configured end-of-file-fixer pre-commit hook will reject, and (2) the same attacker-controlled commit (7baf603425) that injected the payloads also made substantive, unreverted code changes to the app's initialization path (preamble.ts, views/index.tsx) and backend locale handling (base.py), none of which are addressed by this PR series.

💬 General Feedback

• security: CRITICAL — Three files from the confirmed attacker commit (7baf603425, author Tu Shaokun / tt-a1i) have NOT been reverted as part of this incident response:

1. superset-frontend/src/preamble.ts — refactored the entire app-initialization flow into an exported async initPreamble() function, added a fetch() call to /superset/language_pack/{lang}/ with an AbortController timeout, and changed how configure() / initFeatureFlags() / setupColors() are called. This file executes on every page load.
2. superset-frontend/src/views/index.tsx — changed the entry point from a synchronous ReactDOM.render(<App />) to an async IIFE that awaits initPreamble() before rendering, and imports logging from @apache-superset/core.
3. superset/views/base.py — changed the locale-to-language extraction to use isinstance(locale, Locale) / isinstance(locale, str) / fallback to app.config.get('BABEL_DEFAULT_LOCALE', 'en').

The config-file injections in this PR are byte-for-byte identical across all three infected files, making them easy to detect. The code changes above contain no obviously obfuscated payload, but they originate from the same compromised contributor session and have not been audited by a trusted team member. The initialization-path changes (preamble.ts, views/index.tsx) in particular warrant explicit review before trusting them in production. Recommended action: either (a) revert commit 7baf603425 entirely and re-land only the legitimate i18n fix as a clean, independently authored commit, or (b) have a trusted engineer perform a line-by-line audit of all three files against their pre-infection state and explicitly sign off.

• security: The signature-driven supply-chain malware scanner (scanner.py, pollinrider.yml, generic-config-injection.yml, security-scan.yml) developed on branch ft-security-ci was never merged to master. The scanner workflow is designed to block PRs containing PolinRider indicators before they can be merged, and it would have caught exactly the payloads removed across PRs #2–#4. Without it, future infections of this type will not be automatically detected. Merge the ft-security-ci branch (or cherry-pick the four files it adds) into master as a follow-up to this remediation series.

[vulcanho]

Missing trailing newline not restored — pre-commit end-of-file-fixer will fail

The file ends without a trailing newline (\ No newline at end of file in the diff). The pre-infection version of this file (commit 73e095db8e and earlier) ended with };\n. The infection commit 7baf603425 lost the trailing newline by appending the payload directly after }; on the same line, and this cleanup preserves that regression. The end-of-file-fixer pre-commit hook is configured in .pre-commit-config.yaml and will auto-fail on both files. Add a trailing newline to fully restore the pre-infection state.

Also applies to: superset-embedded-sdk/babel.config.js:L26

Suggested change

	};
	};

Prompt for agents

In `docs/babel.config.js` at line 32, and in `superset-embedded-sdk/babel.config.js` at line 26, the files end without a trailing newline (git shows `\ No newline at end of file`). The pre-infection state had a trailing newline. Add a trailing newline to the final `};` line in both files so the `end-of-file-fixer` pre-commit hook passes. The fix is: ensure the last byte of each file is `\n` (i.e., the file ends with `};\n` not just `};`).