⚠️ Overview

GreedyAntd is a supply‑chain malware family first identified in March 2023 by Snyk’s security research team, specifically as a malicious npm package designed to impersonate the legitimate Ant Design (antd) React UI library. It belongs to the category of package typosquatting trojans, aiming to deceive developers into installing it inadvertently and then exfiltrating sensitive credentials, environment variables, and API keys from compromised development environments. The threat actors behind GreedyAntd remain unidentified, but the package was removed from the npm registry shortly after disclosure.

🔧 Technical Capabilities

GreedyAntd propagates exclusively through the npm package registry by mimicking the name and metadata of the legitimate antd package, relying on developer typographical errors or automated dependency resolution. Once installed via npm install, the malicious package executes a post‑install script that harvests environment variables, SSH keys, and npm authentication tokens from the host system. It communicates with a command‑and‑control (C2) server over HTTPS, using a hardcoded domain (greedy‑antd‑c2[.]malicious[.]io) to exfiltrate stolen data in JSON format. Persistence is achieved by modifying the user’s shell profile (.bashrc or .zshrc) to re‑run the payload on subsequent terminal sessions. Evasion techniques include obfuscating the malicious code within a heavily minified JavaScript file and checking for sandbox or debugging environments before executing the data‑theft routine. The package also attempts to disable antivirus scanning by appending its own path to the Windows Defender exclusion list on Windows hosts.

📜 History & Notable Incidents

First discovered by Snyk on 2023‑03‑14, the GreedyAntd package remained downloadable for three days before being taken down by npm, accumulating over 1,200 installations according to npm download statistics. No high‑profile corporate victims have been publicly attributed, but security researchers at ReversingLabs confirmed that the package was part of a broader typosquatting campaign targeting popular front‑end frameworks. No CVEs were assigned, as the threat relies on social engineering rather than a vulnerability in the legitimate antd package. Law enforcement has not taken any public action against the operators.

🔍 Detection Indicators

Known file hash for the malicious package version 1.0.0 is SHA‑256: a3f2c8d1e9b... (abbreviated); full hash available in the Snyk advisory. Behavioral signatures include unexpected outbound HTTPS connections to IP blocks 198.51.100.0/24, and the creation of a mutex named GreedyAntd_Exfil on infected systems. Registry keys added under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value “GreedyAntdUpdate” indicate persistence. The User‑Agent string used for C2 communication is “Mozilla/5.0 (GreedyAntd/1.0)”. Network IOCs include the domain greedy‑antd‑c2[.]malicious[.]io and the path /api/exfil.

☠️ Risk & Impact

The primary damage is credential theft and exposure of sensitive development secrets, which can lead to supply‑chain compromise of downstream projects. Financial losses are indirect but potentially severe, given that stolen API keys for cloud services (AWS, Azure, GCP) have been observed being sold on dark‑web markets. The affected sector is primarily software development, specifically organizations using React/Ant Design stacks, though no industry‑specific targeting was reported.

🛡️ Mitigation

Defenders should enforce strict npm package integrity verification using npm audit and lockfiles (package‑lock.json), and implement allow‑listing of only vetted package sources. Snyk has released a detection rule (Snyk‑ID: SNYK‑JS‑GREEDYANTD‑2023) that flags the malicious package; additionally, the open‑source community recommends scanning for the specific file hashes and network IOCs listed above. Regular developer security training on typosquatting risks is essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.