@coopeuch
LPM Firewall blocks 5 packages in the @coopeuch npm scope. 5 have LPM's own review and are listed first.
OpenSSF Malicious Packages via OSV confirms @coopeuch/config@1.999.999 as malicious (MAL-2026-17762): Malicious code in @coopeuch/config (npm)
The automatic install hook transmits host and consumer-project identifying information to an external collector. This is a concrete data-exfiltration behavior, regardless of the source co...
The manifest automatically runs a hook that collects identifying host and consumer-project information and sends it to an external endpoint without an activation or consent guard. This is...
The automatic install hook collects identifying host and environment information and transmits it to an external endpoint without an opt-in. This is concrete install-time data exfiltration.
The lifecycle hook performs automatic host-data exfiltration to an external endpoint. The absence of credential theft does not make the collection and transmission of identifying host inf...