npm scope
@feedmepos
LPM Firewall blocks 2 packages in the @feedmepos npm scope. 2 have LPM's own review and are listed first.
Oct 21, 2026
@feedmepos/mf-inventory-portal@1.8.0-dev.20
Credential exfiltrationThe reachable 401 refresh path sends the active session token to a fixed host outside the package’s configured service backends. This is concrete credential disclosure supporting a publis...
Sep 5, 2026
@feedmepos/mf-payment@1.11.6
Install hook abuseThe package contains a concrete automatic install hook that runs a package manager against an external relative directory. The browser bundle findings do not mitigate this install-time mu...
Each card opens the package page with its evidence and every recorded version.