/incidentsfield log

Catches Campaigns Exfil Patterns LLM Incidents Methodology

↺rss ↗cremit.io

incidents.cremit.io

A reference feed of real-world Non-Human Identity (NHI) credential leak incidents. Maintained by Cremit.

Browse

All incidents
npm supply chain
CI/CD compromise
Methodology

Subscribe

RSS feed
@cremit_io
GitHub

// status

monitor active

// build

2026-10-02

// origin

cremit · seoul, kr

// license

© 2026 Cremit. content reuse encouraged with attribution.

codebuff-cli flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

home/packages/npm/codebuff-cli

// npm package

codebuff-cli

[English](./README.md) | 简体中文

↗npmjs.com ↗tarball

versions

38

maintainers

1

license

Apache-2.0

first publish

2026-05-21

publisher

imjustbetterxd

tarball

298,442,363 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-26

// offending code· @1.1.9· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — no network destinations.

@1.1.9·2026-05-26·AUTO-PUBLISHED·publisher: imjustbetterxd
heuristic 75/100
static flags 1
llm benign (0.85) via ollama
tarball-size-jump:99xnew-publisher:5dhuge-tarball:285mbmature-packageosv-flagged:MAL-2026-4533oversize-tarball-skipped
→ No suspicious destination, no remote-exec shape — no network destinations.
// offending code· no static-pattern hitspatterns: 1
```
(tarball 110507720 bytes > 20971520 cap; static analysis skipped)
```

(tarball 110507720 bytes > 20971520 cap; static analysis skipped)