Cremit
/incidentsfield log
CatchesCampaignsExfilPatternsLLMIncidentsMethodology
↺rss↗cremit.io

incidents.cremit.io

A reference feed of real-world Non-Human Identity (NHI) credential leak incidents. Maintained by Cremit.

Browse

  • All incidents
  • npm supply chain
  • CI/CD compromise
  • Methodology

Subscribe

  • RSS feed
  • @cremit_io
  • GitHub
// status
monitor active
// build
2026-05-20
// origin
cremit · seoul, kr
// license
CC BY 4.0

© 2026 Cremit. content reuse encouraged with attribution.

campaigns/shared NHI target

git credentials

gitconfig-credentials
members
2
combined blast
—
last alerted
—
fire count
0

// members

Every caught package that currently matches this cluster's axis, replayed live over the last 7 days. Snippets show where the cluster identifier appears in the package's static excerpt or which takeover heuristic fired.

  • npm/@openclaw-cn/cli·@1.3.1·18h ago·jiulingyun
    export const getApiUrl = () => { return process.env.OPENCLAW_API_URL || config.get('api_url') || 'https://backend.clawd.org.cn/api'; }

    llm: No suspicious destination, no remote-exec shape — 1 other host(s).

  • npm/·@1.4.2·18h ago·
    let imports = {}; imports['__wbindgen_placeholder__'] = module.exports; let wasm; const { TextDecoder, TextEncoder } = require(`util`);

    llm: No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@antv/layout-wasm
iaaron
← back to all campaigns