@ecg-internal
LPM Firewall blocks 6 packages in the @ecg-internal npm scope. 4 have LPM's own review and are listed first.
The automatic install hook and fixed-recipient transmission of host-identifying metadata establish unconsented installation-time data disclosure. This supports blocking publication as dat...
The automatic postinstall disclosure of host and project identifiers to an unrelated hard-coded endpoint is a concrete installation-time data exfiltration behavior. This supports blocking...
The package automatically sends host-identifying metadata to a fixed external collector during installation, with no affirmative consent guard in the inspected source. This is concrete in...
The package automatically sends host and installation identifiers to a fixed external collector during postinstall, with an additional import-time trigger. This is concrete, unconsented i...
OpenSSF Malicious Packages via OSV confirms @ecg-internal/adobe-dmp-js@99.0.1 as malicious (MAL-2026-18206): Malicious code in @ecg-internal/adobe-dmp-js (npm)
OpenSSF Malicious Packages via OSV confirms @ecg-internal/reviews-dialog-ui@99.0.1 as malicious (MAL-2026-18211): Malicious code in @ecg-internal/reviews-dialog-ui (npm)