An attacker force-pushed a forged commit into the legitimate antd-img-crop GitHub repository, adding a build hook that installed the cross-platform OverLord credential stealer and remote-access agent. The same payload was distributed through a fake Amber Group recruitment portal and a sideloaded, self-deleting VS Code or Cursor extension, with cryptocurrency wallets, developer credentials, and SSH material among its targets. SafeDep found that the recruitment pretext, clipboard-based verification flow, and developer targeting match the DPRK-linked Contagious Interview campaign, while cautioning that this technique-based overlap does not prove attribution. The published npm package was not affected.