OverLord stealer: forged commit force-pushed to antd-img-crop GitHub repo steals credentials on build
Severity: high · Patch status: unpatched · Since 2026-11-03
On 2026-10-31 at 15:12 UTC someone using the maintainer's account force-pushed commit 2aa8504 onto main of the antd-img-crop GitHub repository. It replaced the legitimate 4.30.0 commit 9ed87c0c7, which has the same author, date and message, and adds a prebuild hook that runs scripts/prebuild.js on npm run build. The hook fetches a fake deepfakeguard installer, which in turn pulls encrypted second-stage JavaScript whose server is found through a GitLab dead-drop. That stage steals browser passwords and cookies, keychain and keyring secrets, crypto wallets, SSH keys and .env/.npmrc files on macOS, Linux and Windows, and installs a remote-control agent disguised as Google software. SafeDep published the analysis on 2026-11-03. The first public report we found is GitHub issue 329 at 10:16 UTC that day, opened by the account KunalSin9h, which appears to be the SafeDep author (the article links the same handle on LinkedIn; the article itself does not say how the campaign was found). At about 12:30 UTC on 2026-11-03 the forged commit was still the head of main, with no revert and no maintainer reply on the issue. The npm package is not affected by the evidence we could check: its latest version 4.30.0 was published 2026-03-12, its manifest has no prebuild or install script, and no version has been published since. Anyone who clones or builds the GitHub main branch remains exposed until the commit is removed and the account is recovered. No vendor fix exists, so affected build machines need rebuilding and their credentials rotating.
What to do
- Do not clone, build or install from the antd-img-crop GitHub main branch until the forged commit is removed; the legitimate 4.30.0 commit is 9ed87c0c7. The npm release 4.30.0 predates the compromise, but its tarball was not inspected here
- Isolate and rebuild any machine that ran npm run build on the repo's main branch after 2026-10-31; treat all credentials on it as stolen
- Rotate SSH keys, npm/Git tokens, browser-saved passwords, wallet seed material and keychain/keyring secrets from clean devices
- Hunt for persistence: com.google.UpdateSupporter LaunchDaemon, google-agent.service, GoogleUpdateSupporterNode scheduled task, short-lived SYSTEM tasks (ABES######, CNGS######, CNG??????, WU??????), and buildwithknexus[.]xyz/check_m in macOS login scripts
- Block IOCs: icagllmbt[.]space, api.gaganata[.]ink, api.fallgganata[.]ink, api.chestsoi[.]ink, buildwithknexus[.]xyz, gitlab[.]com/drop-indexings/tasks; hash-block commit 2aa850469fa1ff2e2efe8eebdf1e085e4d11212a and prebuild.js 2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d
- Warn developers about fake recruiter/job-portal 'verification' clipboard commands and sideloaded VS Code/Cursor extensions (google-dev-tools.google-update-support)
- Pin and verify commit hashes / require signed commits with Verified badges before building from upstream repos; the forged commit is unsigned
Sources
All live incidents on Threat Watch
