/incidentsfield log

Catches Campaigns Exfil Patterns LLM Incidents Methodology

↺rss ↗cremit.io

incidents.cremit.io

A reference feed of real-world Non-Human Identity (NHI) credential leak incidents. Maintained by Cremit.

Browse

All incidents
npm supply chain
CI/CD compromise
Methodology

Subscribe

RSS feed
@cremit_io
GitHub

// status

monitor active

// build

2026-05-20

// origin

cremit · seoul, kr

// license

© 2026 Cremit. content reuse encouraged with attribution.

home/patterns/reads-chromium-creds

// Browsers

Static pattern: reads-chromium-creds

pattern: reads-chromium-creds

Packages whose static analysis matched this pattern. See the per-package detail pages for the offending code excerpt.

1 package flagged with this pattern. Newest first.

AUTO-PUBLISHED/npm/2019-09-05/MAL-2026-4090
@antv/torch@1.0.6
by atool
torchjs for @antv.
steals →Chromium logins
reads-chromium-credsreads-env-varschild-process-spawn
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
weekly
—
/wk
llm verdict
benign 0.85

h-score

75

patterns

3

size

38.9 KB

versions

7

Static pattern: reads-chromium-creds — 1 caught | Cremit · NHI Credential Stealer Index