Cremit
/incidentsfield log
CatchesCampaignsExfilPatternsLLMIncidentsMethodology
↺rss↗cremit.io

incidents.cremit.io

A reference feed of real-world Non-Human Identity (NHI) credential leak incidents. Maintained by Cremit.

Browse

  • All incidents
  • npm supply chain
  • CI/CD compromise
  • Methodology

Subscribe

  • RSS feed
  • @cremit_io
  • GitHub
// status
monitor active
// build
2026-05-20
// origin
cremit · seoul, kr
// license
CC BY 4.0

© 2026 Cremit. content reuse encouraged with attribution.

campaigns/shared NHI target

AWS IMDS metadata service

imds-awsrefire #12
members
3
combined blast
—
last alerted
1h ago
2026-05-20
fire count
12
first alerted 7h ago

// members

Every caught package that currently matches this cluster's axis, replayed live over the last 7 days. Snippets show where the cluster identifier appears in the package's static excerpt or which takeover heuristic fired.

  • npm/stripe-internal-utils·@1.0.0·7h ago·dewifewi
    https.get('https://api.ipify.org'

    llm: Sends to suspicious destination: wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.

  • npm/·@11.1.8·8h ago·
    https://api.ipify.org

    llm: Sends to suspicious destination: tjalcgvzuaojvayjfdfh1rtb4ojaobofs.oast.fun.

  • npm/·@1.0.5·10h ago·
    https://api.ipify.org

    llm: Sends to suspicious destination: wvmjioytxqdcokzvflqjv6v35ug1nfyjl.oast.fun.

did-0091
dewifewi
collected-forms-embed-js
fwgewgewgewrhgw
← back to all campaigns