Poisoned Pipeline / Incidents / AS342
A force-pushed commit in antd-img-crop's repository ran a prebuild dropper that installed the OverLord stealer
Git / GitHubnpmDeveloper workstationmacOS softwareLinux distro / packagesWindows software
On 31 October 2026 at 15:12 UTC an attacker force-pushed the default
branch of nanxiaobei/antd-img-crop, an Ant Design image-cropper
component with about 98,000 weekly npm downloads, and left a commit
that installs a credential stealer when a developer runs npm run
build. The npm package is not affected — no published version carries
the payload — so registry scanners see nothing and the exposure is to
anyone who clones the repository and builds it.
Commit 2aa850469fa1ff2e2efe8eebdf1e085e4d11212a is a rebuild of the
real 4.30.0 release commit. It keeps that commit's author, its
12 March date and its message, and adds two things: a
"prebuild": "node scripts/prebuild.js" entry in package.json and the
scripts/prebuild.js file itself. Git lets a committer set the author
and the date to any value, so the repository's commit list still
reads "nanxiaobei committed on Mar 12". The push record is the part
that cannot be forged, and the repository's activity log shows a
force push on 2026-10-31 at 15:12 UTC from the maintainer's account —
the same timestamp GitHub records as the repository's last push.
Maintainers who sign their commits have a second tell: the head
commit loses its Verified badge.
scripts/prebuild.js fetches and runs a second stage posing as a
"deepfake_guard" installer that sets up Node.js, served from
icagllmbt[.]space (registered 12 October) as verify_m for macOS and
Linux and verify_w for Windows. The second stage retrieves a third,
encrypted JavaScript stage that runs in memory and finds its server
through a dead drop on gitlab[.]com/drop-indexings/tasks. That stage
steals credentials and wallets and installs the OverLord agent.
SafeDep documents two further routes into the same stage-2 loader.
One is a fake careers portal for Amber Group, a real cryptocurrency
firm, on the servers that host stage 3: it collects a candidate's
name, email and GitHub profile, then displays a harmless
"verification" command while copying a different one to the
clipboard, and that command downloads verify_m or verify_w. The
other is a self-deleting editor extension named
google-dev-tools.google-update-support. The macOS and Linux agent
contains a cleanup routine that removes that extension's folder and
its entry in extensions.json, and an agent started from a workspace
folder waits two seconds and then deletes the bundle it launched
from plus everything on a cleanup list. The agent never installs the
extension itself, and the extension is on neither the VS Code
Marketplace nor Open VSX; SafeDep assesses that the attacker
sideloads it, plausibly inside a fake take-home repository or as a
.vsix file.
OverLord runs on macOS, Linux and Windows and takes browser passwords
and cookies from Chromium browsers and Firefox, the macOS keychain,
the Linux keyring, browser wallet extensions (MetaMask, Phantom,
Rabby and others), about 34 desktop wallets per operating system
(Exodus, Electrum, Ledger Live, Trezor Suite among them), the
command-line key stores for Solana, Sui, NEAR and Foundry, and .env,
.npmrc, .gitconfig, SSH keys and .kdbx files. On macOS and Linux it
draws a dialog for the login password: on macOS one titled "System
Preferences" reading "macOS needs your password to apply system
updates and verify drivers and security settings", on Linux an
equivalent "Authentication Required" prompt. The password unlocks
further stored secrets and installs the agent with admin rights. It
persists as software presented as Google's — a LaunchDaemon
com.google.UpdateSupporter, a systemd unit google-agent.service, and
a scheduled task GoogleUpdateSupporterNode — and gives the operator
shell commands, file transfer and process control, with screenshots,
the clipboard and remote keyboard and mouse on Windows. To decrypt
protected browser passwords on Windows it runs as SYSTEM for a few
seconds through a scheduled task it creates, runs once and deletes,
under short names such as ABES######, CNGS######, CNG?????? and
WU??????.
The infrastructure is rotated rather than replaced.
buildwithknexus[.]xyz, registered on 5 August, is written into a
macOS login script as a re-infection hook and is now offline;
icagllmbt[.]space, registered on 12 October, serves stage 2. The
operator's OverLord builds derive from a Go module named
overlord-client with OVERLORD_-prefixed configuration. SafeDep reads
the fake recruiter, the paste-a-command "verification" step and the
developer-and-crypto focus as matching the publicly documented
Contagious Interview campaign, and is explicit that the match is
technique, not attribution.
The same maintainer account had already been used this way. On
21 August 2026 it added an install-time dropper to hugo-paper pulling
from buildwithknexus[.]xyz — the push this catalogue recorded in
AS312 — and a commit on 21 October removed it. Only the install hook
changed in hugo-paper, so sites using the theme were unaffected, and
the repository was clean on 3 November. Ten days after the removal
the attacker hit antd-img-crop through a different lifecycle hook, so
SafeDep treats the account as still compromised.
Mapped techniques
- T0113 Compromised user account
- T0195 Spoofed Commits
- T0111 Malicious code contribution to an open-source repository
- T0151 Installation scripts
- T0159 Malicious artifact execution
- T0224 Prompt the user with a spoofed system dialog for their password
- T0172 Runtime backdoor
- T0199 Secret leak
supply-chain antd-img-crop's repository on GitHub
The force push on 31 October came from the maintainer's own
account, and the same account had added the hugo-paper
dropper on 21 August. SafeDep treats the account as still
compromised; nothing published says how it or its push
credentials were taken.
Commit 2aa85046 is a rebuild of the real 4.30.0 commit with
the same author, the same 12 March date and the same message,
so the commit list shows a March commit. What it cannot hide
is the 31 October force push in the repository's activity
log, and it is unsigned where a signed head commit would have
dropped its Verified badge.
The payload is a package.json prebuild entry plus
scripts/prebuild.js on the default branch. No npm release
carries it, so the change lives in the source repository
only.
post-supply-chain Developers who build a cloned checkout
The hook is named prebuild, so it runs on npm run build rather
than on npm install. Building a cloned UI component library is
routine, and install-script blocking at install time does not
cover a build-time script.
prebuild.js downloads verify_m or verify_w from
icagllmbt[.]space and runs it; the second stage fetches an
encrypted third stage that executes in memory and resolves
its server through a GitLab dead drop before installing the
agent.
The macOS build shows a dialog titled "System Preferences"
and the Linux build an "Authentication Required" prompt,
both asking for the login password under a system-update
pretext. The password opens the keychain or keyring and
authenticates the install that makes the agent persistent.
The user can refuse; nothing in the chain forces an answer.
OverLord gives the operator shell commands, file transfer and
process control, plus screenshots, clipboard and remote
keyboard and mouse on Windows, from a LaunchDaemon, a systemd
unit and a scheduled task all named for Google software.
Browser passwords and cookies, the macOS keychain and Linux
keyring, browser wallet extensions, about 34 desktop wallets
per operating system, four CLI key stores, and .env, .npmrc,
.gitconfig, SSH keys and .kdbx files are all collected. No
victim count and no confirmed downstream organisation are
published.
Framework gaps noted
- How the maintainer account or its push credentials were taken is not published. The activity log shows the force push from the account, and SafeDep's reading that the account is still compromised rests on the two pushes, ten weeks apart, under the same identity.
- The self-deleting extension is confirmed behaviour — the agent removes google-dev-tools.google-update-support and its extensions.json entry — but the sideloading route is SafeDep's assessment. T0154 describes an extension published to a marketplace and this one is not on any marketplace at all, so it is not mapped; the fake take-home repository it may have arrived in is not documented.
- Persistence as vendor-branded OS services (com.google.UpdateSupporter, google-agent.service, GoogleUpdateSupporterNode) has no technique. AS297 records the same gap for Windows scheduled-task persistence.
- The macOS login-script re-infection hook pointing at buildwithknexus[.]xyz/check_m has no technique; that host is offline, so the hook currently fails.
- The third stage is encrypted and runs in memory, and its decryption is not published, so what it sends and where is described only by category. The listed wallet and keystore names are SafeDep's counts, not an inventory recovered from an infected host.
- No relationship to the MALFEX operator in AS297 is established. Both use a Go RAT built from a module named overlord-client, but SafeDep's assessment points at Contagious Interview, and a shared toolkit name is not evidence of the same operator.
- No victim count, no confirmed compromised organisation, and no npm version is affected; the package was clean as of 3 November, so this story describes reach and capability rather than downstream loss.