Static pattern: reads-azure-creds — 1 caught | Cremit

AUTO-PUBLISHEDMulti-name burst/kitchen-sink · 21/npm/2026-06-06

@blamejs/exceptd-skills3 versions·0.16.23→0.16.25

by dotcoocoo

AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate,

steals →Crypto walletSeed phrasenpm tokenPyPI tokenCargo credsAWS keysGCP credsAzure credsGitHub PATKubeconfigDocker authSSH keysAI API keysMCP configmacOS Keychain1PasswordSlack tokensChromium logins→ sends tohttps://exceptd.com

clipboard-accessreads-env-varspublic-github-pushchild-process-spawnreads-github-tokensreads-homedirreads-ai-api-keysreads-system-info+26

→ Worm self-propagation: package reads .npmrc _authToken AND invokes npm publish in install-path code. Shai-Hulud-class shape — no legitimate package re-publishes OTHER packages from the user's machine.

weekly

—

/wk

llm verdict

malicious 0.96

h-score

patterns

size

35.0 MB

versions

292

AUTO-PUBLISHED/kitchen-sink · 8/npm/2026-06-05

ciphernest2 versions·0.4.0→0.8.4

by vmmuthu31

AI-aware security scanner for VS Code — code vulnerabilities, LLM risks, secrets, dependencies, MCP & agent security

steals →AWS keysAzure credsGitHub PATMCP configAI API keysChromium logins→ sends tohttps://github.com/vmmuthu31/CipherNest.git

public-github-pusheval-dynamicreads-env-varsclipboard-accessreads-github-tokenschild-process-spawnfs-recursive-readreads-aws-creds+7

→ 크리덴셜 읽기 (reads-github-tokens, reads-aws-creds, reads-ai-api-keys, reads-azure-creds) + 외부 전송지 webhook-bin 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

24.3 MB

versions

AUTO-PUBLISHEDMulti-name burst/npm/2026-06-05

@drax/identity-back@3.51.0

by cincarnato

Identity module for user management, authentication and authorization.

steals →Azure creds

reads-env-varsreads-azure-creds

weekly

—

/wk

h-score

patterns

size

898.3 KB

versions

178

AUTO-PUBLISHEDMulti-name burst/npm/2026-06-04

@datacules/agent-identity-store-azure2 versions·0.10.0→0.11.0

by hvrcharon1

Azure Key Vault + Table Storage credential store for @datacules/agent-identity

steals →Azure creds

reads-azure-credsreads-env-vars

weekly

—

/wk

h-score

patterns

size

19.4 KB

versions

AUTO-PUBLISHEDMulti-name burst/npm/2026-06-04

@svar-ui/excel-import-locales@2.6.1

by mkozhukh

Locales for SVAR Excel Import widget

steals →Azure creds

reads-azure-creds

weekly

—

/wk

h-score

patterns

size

11.8 KB

versions

AUTO-PUBLISHED/npm/2026-06-03

pokebedrock-showdown@0.1.17

by smell-of-curry

A modified version of the Pokémon Showdown server, designed for PokeBedrock.

steals →Azure credsChromium logins

public-github-pushreads-chromium-credsreads-azure-credschild-process-spawninstall-path-npm-publisheval-dynamicpastebin-domainreads-env-vars

→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 pastebin-domain 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

135.9 MB

versions

AUTO-PUBLISHEDMulti-name burst/npm/2026-06-03

@codeplex-sac/ui@0.0.17

by codeplexdev

steals →Azure creds

reads-env-varschild-process-spawnreads-azure-creds

weekly

—

/wk

h-score

patterns

size

861.8 KB

versions

AUTO-PUBLISHEDMulti-name burst/npm/2026-06-03

@boldreports/javascript-reporting-controls@13.1.35

by bold-reports

The Bold Reports by Syncfusion controls for JavaScript contains ReportViewer and ReportDesigner HTML5 and JavaScript reporting controls for enterprise web development

steals →Azure credsChromium logins→ sends tohttps://github.com/boldreports/javascript-reporting-controls.git

public-github-pushreads-chromium-credsclipboard-accessreads-azure-credsfunction-constructorchild-process-spawnhttp-to-public-ip

→ 크리덴셜 읽기 (reads-azure-creds) + 외부 전송지 http-to-public-ip 조합 — 전형적인 유출 패턴.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

80.0 MB

versions

271

AUTO-PUBLISHEDOSV advisory/kitchen-sink · 8/npm/2026-05-28/MAL-2026-4543

customerdigital-ui-containers-lib@99.16.9

by hacktest49

Interface utility for performance monitoring and diagnostic reporting.

steals →npm tokenAWS keysGCP credsAzure credsDocker authKubeconfigSSH keys

reads-aws-credsreads-gcp-credsreads-azure-credsreads-docker-credsreads-kube-credsreads-ssh-keysreads-npmrcreads-shell-history+3

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

6.9 KB

versions

AUTO-PUBLISHEDOSV advisory/npm/2026-05-15/MAL-2026-4606

martinez-polygon-clipping-tony@0.9.5

by christiano_129

Martinez polygon clipping algorithm, does boolean operation on polygons (multipolygons, polygons with holes etc): intersection, union, difference, xor

steals →Azure creds→ sends tohttps://github.com/daltonchristiano060-gif/dalton-martinez.git

public-github-pushreads-azure-credsreads-env-varsreads-system-infochild-process-spawn

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

41.8 KB

versions

AUTO-PUBLISHEDOSV advisory/kitchen-sink · 11/npm/2026-05-26/MAL-2026-4497

bingocode@1.1.150

by leanchy

steals →npm tokenGCP credsAWS keysAzure credsGitHub PATSSH keysAI API keysMCP configmacOS Keychain

reads-env-varsfs-recursive-readreads-ai-api-keysclaude-agent-config-injectionchild-process-spawnreads-gcp-credsreads-keychainreads-npmrc+9

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

34.9 MB

versions

123

AUTO-PUBLISHEDOSV advisory/kitchen-sink · 8/npm/2026-05-16/MAL-2026-4379

@deadcode09284814/axios-util@1.0.1

by deadcode09284814

steals →npm tokenAWS keysGCP credsAzure credsSSH keys

reads-aws-credsreads-gcp-credsreads-azure-credsreads-ssh-keysreads-npmrcreads-homedirreads-shell-historyreads-system-info+1

→ 하드코딩된 public IP 전송지: 80.200.28.28 (RFC1918·loopback 아님).

weekly

—

/wk

llm verdict

malicious 0.90

h-score

100

patterns

size

3.7 KB

versions