Cremit
/incidentsfield log
탐지캠페인유출지패턴LLM사고 사례방법론
↺rss↗cremit.io

incidents.cremit.io

실제 발생한 비인간 식별자(NHI) 크리덴셜 유출 사고를 정리한 인덱스. 운영: Cremit

둘러보기

  • 전체 사고
  • npm 공급망
  • CI/CD 침해
  • 방법론

구독

  • RSS 피드
  • @cremit_io
  • GitHub
// 상태
모니터 가동중
// 빌드
2026-07-17
// 출처
cremit · 서울, 대한민국
// 라이선스
CC BY 4.0

© 2026 Cremit. 출처 표시 시 자유롭게 재사용 가능.

home/campaigns/npm/neoddish

// publisher 캠페인 · npm

neoddish

npm의 neoddish 계정이 publish한 catch 패키지 전체와, registry가 현재 노출하는 author·maintainer 정보. 같은 이메일이나 이름이 여러 패키지에 걸쳐 등장하면, 한 명이 여러 throwaway 계정을 운영한다는 강한 증거입니다.

↗npmjs.com publisher↗pypi.org user
패키지
7
고유 이름 수
탐지 이벤트
7
버전 × 이름
blast
239/wk
주간 다운로드 합계
활동 기간
2026-05-19 → 2026-05-19
최초 → 최근 탐지

// publisher OSINT

이 계정 자체에 대한 시그널. 활동 기간이 짧으면 throwaway 가능성이 큽니다. 이메일 도메인을 보면 단발 webmail인지 진짜 조직 메일인지 한눈에 갈리고, 같은 핸들이 여러 registry에 있으면 같은 운영자라고 볼 강한 근거가 됩니다. GitHub 링크가 잡히면 실명 식별까지 곧장 이어집니다.

npm 활동
  • registry 패키지 수: 7
  • 최초 publish: 2019-12-17
  • 최근 publish: 2023-03-20
  • 활동 기간: 1189일
다른 registry의 같은 핸들
  • npm /~neoddish: 존재함 ↗
  • pypi /user/neoddish: 존재함 ↗
  • github.com/neoddish: 존재함 ↗
이메일 도메인
  • qq.com×49webmail
  • gmail.com×35webmail
  • 163.com×14webmail
  • outlook.com×7webmail
  • antgroup.com×7

// 다른 publisher와 공유되는 이메일

이 캠페인의 이메일이 다른 publisher 계정의 catch 패키지에도 등장하는 경우. 한 운영자가 두 계정을 같이 굴리고 있다는 강한 증거입니다.

  • yunji.me@outlook.com
    also on 5 packages from 1 other publisher:
    • by
    • by
    • by
    • by
    • by
  • 943720372@qq.com
    also on 5 packages from 1 other publisher:
    • by
    • by
    • by
    • by
    • by
  • jinke.li666@gmail.com
    also on 5 packages from 1 other publisher:
    • by
    • by
    • by
    • by
    • by
  • 120635640@qq.com
    also on 5 packages from 1 other publisher:

// 공유 author 식별자

같은 이메일·이름이 캠페인 안 여러 패키지에 등장하는 경우. publisher 계정 외에 별도로 잡히는 직접적인 attribution 증거입니다.

emails
  • yunji.me@outlook.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • 943720372@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • jinke.li666@gmail.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • 120635640@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • army8735@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • dengfuping_private@163.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • afc163@gmail.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • chenluuli@gmail.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • 1175863618@qq.com

// 패턴 풋프린트

캠페인 전반에서 어떤 정적 분석 플래그가 얼마나 자주 매칭됐는지. "이 캠페인이 결국 어떤 종류의 stealer인가"에 대한 요약 답.

  • ×2
  • ×1

// npm에 등록된 전체 활동

이 계정이 지금 registry에 올려둔 모든 패키지 (최신순). ● Cremit 파이프라인이 catch · ○ 아직 미검출.0/7 catch.

  • ○
    antv-site-demo-rc@ 1.1.0

    Encapsulation for components of demos in AntV site.

    2023-03-20
  • ○
    rfm-cli@ 0.1.0-alpha.5

    rfm(Rim Forming Machine) - CLI Scaffold for quick project kickoff.

    2022-05-13
  • ○
    color-schema@ 0.2.0

    JSON Schema for Color Palette

    2021-07-14
  • ○
    color-schema-test@ 0.1.8

// 이 캠페인의 패키지

고유 이름 7개 · 최신순
  • ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • npm/@antv/l7by lzxue
  • npm/@antv/l7-mapsby lzxue
  • npm/@antv/l7-layersby lzxue
  • npm/@antv/l7-coreby lzxue
  • npm/@antv/l7-componentby lzxue
  • army8735@qq.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • dengfuping_private@163.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • afc163@gmail.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • chenluuli@gmail.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • 1175863618@qq.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • 1491812683@qq.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • zhuyuxin0627@gmail.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • ojh496845051@gmail.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • wzwahl36@qq.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • 610999886@qq.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • alex_zjt@163.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • duxinyue.dxy@antgroup.com
    also on 5 packages from 1 other publisher:
    • npm/@antv/l7by lzxue
    • npm/@antv/l7-mapsby lzxue
    • npm/@antv/l7-layersby lzxue
    • npm/@antv/l7-coreby lzxue
    • npm/@antv/l7-componentby lzxue
  • — @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • 1491812683@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • zhuyuxin0627@gmail.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • ojh496845051@gmail.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • wzwahl36@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • 610999886@qq.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • alex_zjt@163.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • duxinyue.dxy@antgroup.com— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component
  • author names
    • antv— @antv/data-samples, @antv/color-schema, @antv/ckb, @antv/lite-insight, @antv/data-wizard, @antv/thumbnails, @antv/thumbnails-component

    JSON Schema for Color Palette

    2021-06-30
  • ○
    sketch-json-api@ 0.1.0-alpha.26

    A Node.js library for editing `.sketch` files on servers.

    2021-04-08
  • ○
    chart-symbols@ 0.1.0-beta.1

    Symbols of chart types.

    2021-01-07
  • ○
    neo-typescript-examples@ 0.0.1

    TypeScript - Examples & Best Practices.

    2019-12-17
  • ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • AUTO-PUBLISHED/npm/2022-04-26/MAL-2026-3867

    @antv/data-samples@1.0.1

    by neoddish

    Open data set collection for AntV products

    → sends tohttps://github.com/antvis/data-samples.git
    public-github-push

    → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • AUTO-PUBLISHED/npm/2021-11-16/MAL-2026-3861

    @antv/color-schema@0.2.3

    by neoddish

    JSON Schema for Color Palette

    public-github-push

    → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    patterns
    1
    size
    ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • AUTO-PUBLISHED/npm/2023-03-06/MAL-2026-3860

    @antv/ckb@2.0.4

    by neoddish

    Chart Knowledge Base

    → sends tohttps://antv.vision/

    → 의심 전송지 없음, 원격 실행 형태 없음 — 3 known-vendor host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    size
    231.8 KB
    ↳ author:AntVmaintainers: lvisei <yunji.me@outlook.com>, iaaron <943720372@qq.com>, jinke.li <jinke.li666@gmail.com>, lzxue <120635640@qq.com>, army8735 <army8735@qq.com>, dengfuping <dengfuping_private@163.com>, afc163 <afc163@gmail.com>, chenluli <chenluuli@gmail.com>, kn9117 <1175863618@qq.com>, bbsqq <1491812683@qq.com>, banxuan <zhuyuxin0627@gmail.com>, yanxiong <ojh496845051@gmail.com>, atool <wzwahl36@qq.com>, pearl_wang <610999886@qq.com>, alex_zjt <alex_zjt@163.com>, duxinyue023 <duxinyue.dxy@antgroup.com>↗ registry
  • npm/@antv/l7
    lzxue
    npm/@antv/l7-maps
    lzxue
    npm/@antv/l7-layers
    lzxue
    npm/@antv/l7-core
    lzxue
    npm/@antv/l7-component
    lzxue
    npm/@antv/l7
    lzxue
    npm/@antv/l7-maps
    lzxue
    npm/@antv/l7-layers
    lzxue
    npm/@antv/l7-core
    lzxue
    npm/@antv/l7-component
    lzxue
    npm/@antv/l7
    lzxue
    npm/@antv/l7-maps
    lzxue
    npm/@antv/l7-layers
    lzxue
    npm/@antv/l7-core
    lzxue
    npm/@antv/l7-component
    lzxue
    public-github-push
    child-process-spawn
    AUTO-PUBLISHED/npm/2021-11-20/MAL-2026-4088

    @antv/thumbnails@2.0.0

    by neoddish

    Thumbnails of Chart Types.

    → sends tohttp://www.w3.org/2000/svg

    → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    size
    164.9 KB
    versions
    15
    AUTO-PUBLISHED/npm/2021-11-20/MAL-2026-4089

    @antv/thumbnails-component@2.0.0

    by neoddish

    React Component for Thumbnails of Chart Types.

    → sends tohttp://www.w3.org/2000/svg

    → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    size
    51.2 KB
    versions
    2
    AUTO-PUBLISHED/npm/2023-03-06/MAL-2026-4066

    @antv/lite-insight@2.1.1

    by neoddish

    A lite js library for insights retrieval.

    child-process-spawn

    → 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

    weekly
    —
    /wk
    llm verdict
    benign 0.85
    h-score
    75
    patterns
    1
    size
    1.0 MB
    versions
    11
    AUTO-PUBLISHED/npm/2023-03-06/MAL-2026-3869

    @antv/data-wizard@2.0.4

    by neoddish

    A js/ts library for data processing

    → sends tohttps://antv.vision/
    weekly
    239
    /wk
    h-score
    75
    size
    880.2 KB
    versions
    15
    patterns
    1
    size
    1.8 MB
    versions
    5
    161.7 KB
    versions
    3
    versions
    10