npm scope
@lensmcp
LPM Firewall blocks 2 packages in the @lensmcp npm scope. 2 have LPM's own review and are listed first.
Oct 31, 2026
@lensmcp/vite-plugin@1.25.44
Credential exfiltrationThe plugin enables browser replay by default, and the recorder config explicitly leaves password values unmasked before uploading replay data. This automatically collects credentials that...
Oct 30, 2026
@lensmcp/client-runtime@1.25.40
Credential exfiltrationThe default browser replay path records password fields without masking and uploads the recording to the bridge. Credential capture is unrelated to the disclosed event-capture purpose and...
Each card opens the package page with its evidence and every recorded version.