Forged GitHub Commit on antd-img-crop Delivers OverLord Credential Stealer to Developers
On October 31, 2026, attackers force-pushed a forged commit (2aa8504) to antd-img-crop, a popular Ant Design image cropping library with ~98,000 weekly npm downloads. The commit, disguised as the legitimate v4.30.0 release, adds a prebuild hook to package.json that runs on npm run build and fetches a multi-stage payload culminating in OverLord, a credential and cryptocurrency stealer targeting macOS, Linux and Windows. The npm registry package itself is not affected; only the GitHub repository was tampered with. The same campaign also uses a fake Amber Group careers portal and a sideloaded VS Code/Cursor extension (google-dev-tools.google-update-support) as alternate infection vectors, techniques consistent with the publicly documented Contagious Interview campaign targeting developers and crypto holders. SafeDep researchers also found an earlier, now-removed dropper planted by the same compromised maintainer account in the hugo-paper Hugo theme repository on August 21, 2026.
Detalhes técnicos
The forged commit preserves the original author, commit date and message, exploiting the fact that Git allows arbitrary author/date metadata, though the repository's activity log reveals a force push on 2026-10-31 at 15:12 UTC. The malicious scripts/prebuild.js downloads a fake deepfake_guard installer (stage 2) that sets up Node.js, which then fetches encrypted, in-memory JavaScript (stage 3) locating its C2 via a GitLab dead-drop. Stage 3 steals browser passwords/cookies, macOS Keychain, Linux keyring, browser wallet extensions (MetaMask, Phantom, Rabby, and more), ~34 desktop wallets, CLI key stores for Solana, Sui, NEAR and Foundry, plus .env, .npmrc, .gitconfig, SSH keys and .kdbx files. On macOS/Linux it displays a fake system password prompt to harvest admin credentials; on Windows it briefly runs as SYSTEM via a short-lived, self-deleting scheduled task (naming patterns like ABES######, CNGS######) to decrypt protected browser secrets. Persistence is established via fake Google software: a macOS LaunchDaemon (com.google.UpdateSupporter), a Linux service (google-agent.service), and a Windows scheduled task (GoogleUpdateSupporterNode). The agent provides remote shell, file transfer, process control, and on Windows also screenshots, clipboard capture and remote input. Infrastructure includes buildwithknexus[.]xyz (registered Aug 5, now offline, used as a macOS re-infection hook) and the newer icagllmbt[.]space (registered Oct 12) for stage 2 delivery. The fake Amber Group careers portal collects candidate name, email and GitHub profile before tricking victims into copying and running a malicious clipboard command (verify_m/verify_w).
Remediação
Maintainers should enable commit signing and monitor for head commits losing their Verified badge, audit GitHub push/activity logs rather than relying solely on the commit list, and review package.json scripts for unexpected prebuild/postinstall hooks. Developers should avoid running build scripts from unverified repository states, inspect installed VS Code/Cursor extensions for google-dev-tools.google-update-support, and treat unsolicited recruiter outreach requesting terminal command execution as high risk. Defenders can hunt for short-lived SYSTEM-level scheduled tasks matching the identified naming patterns and for the named Google-impersonating persistence mechanisms.
Linha do tempo
-
Forged GitHub Commit on antd-img-crop Delivers OverLord Credential Stealer to Developers
ler a análise desta fonte ocultar
On October 31, 2026, attackers force-pushed a forged commit (
2aa8504) to antd-img-crop, a popular Ant Design image cropping library with ~98,000 weekly npm downloads. The commit, disguised as the legitimate v4.30.0 release, adds aprebuildhook topackage.jsonthat runs onnpm run buildand fetches a multi-stage payload culminating in OverLord, a credential and cryptocurrency stealer targeting macOS, Linux and Windows. The npm registry package itself is not affected; only the GitHub repository was tampered with. The same campaign also uses a fake Amber Group careers portal and a sideloaded VS Code/Cursor extension (google-dev-tools.google-update-support) as alternate infection vectors, techniques consistent with the publicly documented Contagious Interview campaign targeting developers and crypto holders. SafeDep researchers also found an earlier, now-removed dropper planted by the same compromised maintainer account in thehugo-paperHugo theme repository on August 21, 2026.Technical Details
The forged commit preserves the original author, commit date and message, exploiting the fact that Git allows arbitrary author/date metadata, though the repository's activity log reveals a force push on 2026-10-31 at 15:12 UTC. The malicious
scripts/prebuild.jsdownloads a fakedeepfake_guardinstaller (stage 2) that sets up Node.js, which then fetches encrypted, in-memory JavaScript (stage 3) locating its C2 via a GitLab dead-drop. Stage 3 steals browser passwords/cookies, macOS Keychain, Linux keyring, browser wallet extensions (MetaMask, Phantom, Rabby, and more), ~34 desktop wallets, CLI key stores for Solana, Sui, NEAR and Foundry, plus.env,.npmrc,.gitconfig, SSH keys and.kdbxfiles. On macOS/Linux it displays a fake system password prompt to harvest admin credentials; on Windows it briefly runs as SYSTEM via a short-lived, self-deleting scheduled task (naming patterns likeABES######,CNGS######) to decrypt protected browser secrets. Persistence is established via fake Google software: a macOS LaunchDaemon (com.google.UpdateSupporter), a Linux service (google-agent.service), and a Windows scheduled task (GoogleUpdateSupporterNode). The agent provides remote shell, file transfer, process control, and on Windows also screenshots, clipboard capture and remote input. Infrastructure includesbuildwithknexus[.]xyz(registered Aug 5, now offline, used as a macOS re-infection hook) and the newericagllmbt[.]space(registered Oct 12) for stage 2 delivery. The fake Amber Group careers portal collects candidate name, email and GitHub profile before tricking victims into copying and running a malicious clipboard command (verify_m/verify_w).Remediation
Maintainers should enable commit signing and monitor for head commits losing their Verified badge, audit GitHub push/activity logs rather than relying solely on the commit list, and review
package.jsonscripts for unexpectedprebuild/postinstallhooks. Developers should avoid running build scripts from unverified repository states, inspect installed VS Code/Cursor extensions forgoogle-dev-tools.google-update-support, and treat unsolicited recruiter outreach requesting terminal command execution as high risk. Defenders can hunt for short-lived SYSTEM-level scheduled tasks matching the identified naming patterns and for the named Google-impersonating persistence mechanisms.