--- title: "antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer" description: "A forged commit force-pushed to the antd-img-crop GitHub repository runs a dropper on npm run build that installs a cross-platform stealer and remote-access agent called OverLord. The npm package is clean." url: "https://safedep.io/blog/antd-img-crop-forged-commit-overlord-stealer" author: "Kunal Singh" published: "2026-11-03" --- # antd-img-crop GitHub Repository Hijacked to Deliver OverLord Stealer A forged commit in the `antd-img-crop` GitHub repository installs a credential stealer called OverLord when a developer runs `npm run build`. The npm package is not affected. ## TL;DR - On October 31, 2026, an attacker force-pushed a forged commit to [`antd-img-crop`](https://github.com/nanxiaobei/antd-img-crop), an Ant Design image cropper with about 98,000 weekly npm downloads. The commit adds a `prebuild` hook that runs on `npm run build`. - The malware steals browser passwords, cookies, keychains, cryptocurrency wallets, SSH keys and `.env` files on macOS, Linux and Windows, then installs a remote-access agent disguised as Google software. - The same payload has two more ways in. One is a fake Amber Group careers portal. The other is most likely a sideloaded VS Code or Cursor extension that the malware deletes after it runs. - The methods match the Contagious Interview campaign that targets developers. ## The forged commit ![GitHub diff of commit 2aa8504 in nanxiaobei/antd-img-crop adding a prebuild script to package.json and a new scripts/prebuild.js that downloads verify_m or verify_w from icagllmbt.space](https://safedep.io/_next/static/immutable/media/antd-img-crop-forged-commit-2aa8504.1ty95pz_fc0__.png) The malicious commit `2aa8504` is a rebuild of the real 4.30.0 release commit. It keeps the same author, date (March 12) and message, and adds two things. The first is a new script entry in `package.json`: ```json title="package.json @ 2aa8504" "prebuild": "node scripts/prebuild.js" ``` The second is the `scripts/prebuild.js` file itself. Git lets the committer set the author and date to any value, so GitHub's commit list still shows `nanxiaobei committed on Mar 12`. The committer cannot fake GitHub's push record. The repository's [activity log](https://github.com/nanxiaobei/antd-img-crop/activity) shows a force push on 2026-10-31 at 15:12 UTC, made from the maintainer's account, that the commit list hides. Maintainers who sign their commits can also watch for a head commit that loses its **Verified** badge. ## How the payload reaches a machine The hijacked repository and a fake job portal lead to the same stage 2 loader. In the repository path, `prebuild.js` downloads and runs stage 2, a fake `deepfake_guard` installer that sets up Node.js. Stage 2 fetches stage 3, encrypted JavaScript that runs in memory and finds its server through a GitLab dead-drop. Stage 3 steals credentials and wallets and installs the OverLord agent. The servers that host stage 3 also host a fake careers portal for Amber Group, a real cryptocurrency firm. It collects a candidate's name, email and GitHub profile, then displays a harmless "verification" command but copies a different one to the clipboard. That command downloads and runs `verify_m` or `verify_w`, the same file names as the stage 2 loader. ![Fake Amber Group careers portal that collects candidate details and copies a malicious verification command](https://safedep.io/_next/static/immutable/media/antd-img-crop-fake-amber-careers-portal.2_chyn06xxvv3.png) ### The editor extension that erases itself The macOS and Linux agent has a cleanup routine that deletes a VS Code or Cursor extension named `google-dev-tools.google-update-support`, both its folder and its entry in `extensions.json`. The agent never installs this extension itself. Started from a workspace folder, the agent waits two seconds, then deletes the bundle it launched from and every file on a cleanup list. The extension is on neither the VS Code Marketplace nor Open VSX. SafeDep's assessment is that the attacker sideloads it, plausibly inside a fake take-home assignment repository or as a `.vsix` file. That makes it a third entry point into the same payload. ## Rotated infrastructure The final payload writes `buildwithknexus[.]xyz/check_m` into a macOS login script as a re-infection hook. The attacker registered that domain on August 5, while stage 2 comes from the newer `icagllmbt[.]space`, registered on October 12. The attacker rotates delivery hosts and keeps older ones in secondary roles. `buildwithknexus[.]xyz` is now offline. | Date | Event | | ------ | ----------------------------------------------------------- | | Aug 5 | `buildwithknexus[.]xyz` registered | | Aug 25 | Source revision of the OverLord agent builds | | Oct 12 | `icagllmbt[.]space` registered | | Oct 31 | `antd-img-crop` poisoned, stage 2 from `icagllmbt[.]space` | ## What OverLord does on an infected machine The malware runs on macOS, Linux and Windows. It steals: - browser passwords and cookies (Chromium browsers and Firefox) - the macOS Keychain and the Linux keyring - browser wallet extensions (MetaMask, Phantom, Rabby and dozens more) - about 34 desktop wallets per operating system (Exodus, Electrum, Ledger Live, Trezor Suite and others) - command-line key stores for Solana, Sui, NEAR and Foundry - `.env`, `.npmrc`, `.gitconfig`, SSH keys and `.kdbx` files On macOS and Linux it shows a fake system dialog that asks for the user's password. On macOS the dialog carries the title "System Preferences" and reads "macOS needs your password to apply system updates and verify drivers and security settings". Linux shows a similar "Authentication Required" prompt. The malware then uses the password to unlock more stored secrets and install itself with admin rights. It persists as fake Google software: - macOS: `com.google.UpdateSupporter` LaunchDaemon - Linux: `google-agent.service` - Windows: scheduled task `GoogleUpdateSupporterNode` The agent gives the attacker remote control, with shell commands, file transfer and process control. On Windows it also captures screenshots and the clipboard and allows remote keyboard and mouse input. To decrypt protected browser passwords on Windows, the stealer runs as SYSTEM for a few seconds through a scheduled task that it creates, runs once and deletes. The task names follow short patterns such as `ABES######`, `CNGS######`, `CNG??????` and `WU??????`. Defenders can alert on these short-lived SYSTEM tasks. ## Who is behind it The attacker built the agents from a Go module named `overlord-client`, and their configuration uses `OVERLORD_*` settings, so the operators call their toolkit OverLord. The fake recruiter, the paste-a-command "verification" step and the focus on developers and cryptocurrency holders match the publicly documented Contagious Interview campaign. The match rests on technique and does not prove who the operators are. ## An earlier attempt in hugo-paper On August 21, the same maintainer account added a similar install-time dropper to [`hugo-paper`](https://github.com/nanxiaobei/hugo-paper), a Hugo theme, pulling from the same `buildwithknexus[.]xyz` host. A commit on October 21 removed the dropper, and the repository is clean as of November 3. Only the install hook changed, so sites that use the theme were not affected. Ten days later the attacker hit `antd-img-crop`, so SafeDep treats the account as still compromised. ## Indicators of compromise | Type | Value | | -------------------- | ----------------------------------------------------------------------------------------------------------------- | | Malicious commit | `2aa850469fa1ff2e2efe8eebdf1e085e4d11212a` | | `scripts/prebuild.js`| `2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d` | | Infrastructure | `icagllmbt[.]space`, `api.gaganata[.]ink`, `api.fallgganata[.]ink`, `api.chestsoi[.]ink`, `buildwithknexus[.]xyz` | | Dead-drop | `gitlab[.]com/drop-indexings/tasks` | | macOS re-infection | `buildwithknexus[.]xyz/check_m`, dropped to `/var/tmp/check` | | Editor extension | `google-dev-tools.google-update-support` (VS Code, Cursor) | | Persistence | `com.google.UpdateSupporter`, `google-agent.service`, `GoogleUpdateSupporterNode` | | Windows SYSTEM tasks | `ABES######`, `CNGS######`, `CNG??????`, `WU??????` (short-lived) | The full IOC list: [IoC: antd-img-crop OverLord campaign](https://safedep.io/data/blogs/antd-img-crop-overlord-iocs.csv)