Static pattern: reads-firefox-creds — 1 caught | Cremit

AUTO-PUBLISHED/npm/2026-06-04

youtube-downloader-web@1.0.0

by ragha02

A professional full-stack YouTube Downloader powered by yt-dlp.

steals →Apple/CloudKitChromium loginsFirefox logins

py-pip-install-runtimereads-chromium-credsreads-env-varspy-sys-platform-branchbase64-decodereads-firefox-credsreads-homedirfs-recursive-read+10

→ Credential read (reads-apple-cloudkit) paired with http-to-public-ip destination — classic exfiltration signature.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

12.0 MB

versions

AUTO-PUBLISHEDOSV advisory/npm/2026-05-26/MAL-2026-4823

msc-terminal@3.2.0

by nhpkevte1576

Terminal changelog logger utilities

steals →Seed phraseChromium loginsFirefox logins

reads-chromium-credsreads-firefox-credsreads-seed-phrasereads-env-varsreads-shell-historypublic-github-pushbase64-decodechild-process-spawn+3

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

831.4 KB

versions

AUTO-PUBLISHEDOSV advisory/npm/2026-05-26/MAL-2026-4346

logger-draft@3.2.6

by mufu202633

Terminal logger utilities

steals →Seed phraseChromium loginsFirefox logins

reads-chromium-credsreads-firefox-credsreads-seed-phrasereads-env-varsreads-shell-historypublic-github-pushbase64-decodechild-process-spawn+3

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

weekly

794

/wk

llm verdict

benign 0.85

h-score

patterns

size

831.1 KB

versions