/incidentsfield log

Catches Campaigns Exfil Patterns LLM Incidents Methodology

↺rss ↗cremit.io

incidents.cremit.io

A reference feed of real-world Non-Human Identity (NHI) credential leak incidents. Maintained by Cremit.

Browse

All incidents
npm supply chain
CI/CD compromise
Methodology

Subscribe

RSS feed
@cremit_io
GitHub

// status

monitor active

// build

2026-05-20

// origin

cremit · seoul, kr

// license

© 2026 Cremit. content reuse encouraged with attribution.

home/patterns/long-hex-literal

// Code execution / obfuscation

Static pattern: long-hex-literal

pattern: long-hex-literal

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

1 package flagged with this pattern. Newest first.

AUTO-PUBLISHED/npm/2025-04-21/MAL-2026-4093
@antv/vendor@1.0.11
by bqxbqxbqx
Vendored dependencies to fix ERR_REQUIRE_ESM.
→ sends tohttps://github.com/d3/d3-dispatch/blob/main/LICENSE
child-process-spawnlong-base64-literallong-hex-literal
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
weekly
—
/wk
llm verdict
benign

0.85

h-score

75

patterns

3

size

1.2 MB

versions

13

Static pattern: long-hex-literal — 1 caught | Cremit · NHI Credential Stealer Index