@hashbrownai
LPM Firewall blocks 6 packages in the @hashbrownai npm scope. 6 have LPM's own review and are listed first.
The automatic postinstall reports Git display name, email, and repository-owner metadata to the vendor’s endpoint without consent. This meets the install-time data-exfiltration rule.
The default install hook transmits user-identifying Git configuration to the publisher’s endpoint, which qualifies as install-time data exfiltration. The opt-out does not make the default...
The automatic postinstall hook sends configured Git display names and email addresses to the package vendor’s collection endpoint without explicit consent. Because this collects personal...
The default postinstall sends Git display names and email addresses to the vendor endpoint, which is install-time disclosure of user data without consent. The runtime entry point is separ...
The package’s default postinstall sends Git identity, including the configured name and email, along with install context to its vendor endpoint without an explicit consent prompt. This i...
Source confirms automatic postinstall disclosure of identifying installation and environment data to a publisher-selected endpoint, with no affirmative consent gate. This is a concrete in...