antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer

A forged commit in the antd-img-crop GitHub repository installs a credential stealer called OverLord when a developer runs npm run build. The npm package is not affected.

TL;DR

• On October 31, 2026, an attacker force-pushed a forged commit to antd-img-crop⁠(opens in new tab), an Ant Design image cropper with about 98,000 weekly npm downloads. The commit adds a prebuild hook that runs on npm run build.
• The malware steals browser passwords, cookies, keychains, cryptocurrency wallets, SSH keys and .env files on macOS, Linux and Windows, then installs a remote-access agent disguised as Google software.
• The same payload has two more ways in. One is a fake Amber Group careers portal. The other is most likely a sideloaded VS Code or Cursor extension that the malware deletes after it runs.
• The methods match the Contagious Interview campaign that targets developers.

The forged commit

The malicious commit 2aa8504 is a rebuild of the real 4.30.0 release commit. It keeps the same author, date (March 12) and message, and adds two things. The first is a new script entry in package.json:

"prebuild": "node scripts/prebuild.js"

The second is the scripts/prebuild.js file itself. Git lets the committer set the author and date to any value, so GitHub’s commit list still shows nanxiaobei committed on Mar 12.

The committer cannot fake GitHub’s push record. The repository’s activity log⁠(opens in new tab) shows a force push on 2026-10-31 at 15:12 UTC, made from the maintainer’s account, that the commit list hides. Maintainers who sign their commits can also watch for a head commit that loses its Verified badge.

How the payload reaches a machine

The hijacked repository and a fake job portal lead to the same stage 2 loader.

In the repository path, prebuild.js downloads and runs stage 2, a fake deepfake_guard installer that sets up Node.js. Stage 2 fetches stage 3, encrypted JavaScript that runs in memory and finds its server through a GitLab dead-drop. Stage 3 steals credentials and wallets and installs the OverLord agent.

The servers that host stage 3 also host a fake careers portal for Amber Group, a real cryptocurrency firm. It collects a candidate’s name, email and GitHub profile, then displays a harmless “verification” command but copies a different one to the clipboard. That command downloads and runs verify_m or verify_w, the same file names as the stage 2 loader.

The editor extension that erases itself

The macOS and Linux agent has a cleanup routine that deletes a VS Code or Cursor extension named google-dev-tools.google-update-support, both its folder and its entry in extensions.json. The agent never installs this extension itself. Started from a workspace folder, the agent waits two seconds, then deletes the bundle it launched from and every file on a cleanup list.

The extension is on neither the VS Code Marketplace nor Open VSX. SafeDep’s assessment is that the attacker sideloads it, plausibly inside a fake take-home assignment repository or as a .vsix file. That makes it a third entry point into the same payload.

Rotated infrastructure

The final payload writes buildwithknexus[.]xyz/check_m into a macOS login script as a re-infection hook. The attacker registered that domain on August 5, while stage 2 comes from the newer icagllmbt[.]space, registered on October 12. The attacker rotates delivery hosts and keeps older ones in secondary roles. buildwithknexus[.]xyz is now offline.

What OverLord does on an infected machine

The malware runs on macOS, Linux and Windows. It steals:

• browser passwords and cookies (Chromium browsers and Firefox)
• the macOS Keychain and the Linux keyring
• browser wallet extensions (MetaMask, Phantom, Rabby and dozens more)
• about 34 desktop wallets per operating system (Exodus, Electrum, Ledger Live, Trezor Suite and others)
• command-line key stores for Solana, Sui, NEAR and Foundry
• .env, .npmrc, .gitconfig, SSH keys and .kdbx files

On macOS and Linux it shows a fake system dialog that asks for the user’s password. On macOS the dialog carries the title “System Preferences” and reads “macOS needs your password to apply system updates and verify drivers and security settings”. Linux shows a similar “Authentication Required” prompt. The malware then uses the password to unlock more stored secrets and install itself with admin rights.

It persists as fake Google software:

• macOS: com.google.UpdateSupporter LaunchDaemon
• Linux: google-agent.service
• Windows: scheduled task GoogleUpdateSupporterNode

The agent gives the attacker remote control, with shell commands, file transfer and process control. On Windows it also captures screenshots and the clipboard and allows remote keyboard and mouse input.

To decrypt protected browser passwords on Windows, the stealer runs as SYSTEM for a few seconds through a scheduled task that it creates, runs once and deletes. The task names follow short patterns such as ABES######, CNGS######, CNG?????? and WU??????. Defenders can alert on these short-lived SYSTEM tasks.

Who is behind it

The attacker built the agents from a Go module named overlord-client, and their configuration uses OVERLORD_* settings, so the operators call their toolkit OverLord.

The fake recruiter, the paste-a-command “verification” step and the focus on developers and cryptocurrency holders match the publicly documented Contagious Interview campaign. The match rests on technique and does not prove who the operators are.

An earlier attempt in hugo-paper

On August 21, the same maintainer account added a similar install-time dropper to hugo-paper⁠(opens in new tab), a Hugo theme, pulling from the same buildwithknexus[.]xyz host. A commit on October 21 removed the dropper, and the repository is clean as of November 3. Only the install hook changed, so sites that use the theme were not affected. Ten days later the attacker hit antd-img-crop, so SafeDep treats the account as still compromised.

Indicators of compromise

The full IOC list: