npm scope
@luoyi-dsh
LPM Firewall blocks 2 packages in the @luoyi-dsh npm scope. 2 have LPM's own review and are listed first.
Oct 30, 2026
@luoyi-dsh/discord-plugin@1.0.2
Credential exfiltrationThe default provider configuration can send OPENAI_API_KEY to api.deepseek.com during ordinary message handling. This is automatic cross-service credential disclosure, so the package shou...
Oct 30, 2026
@luoyi-dsh/instagram-plugin@1.0.11
Credential exfiltrationThe source accepts OPENAI_API_KEY, but by default routes custom LLM requests to api.deepseek.com and sends the key in the Authorization header. Default-enabled background duties can trigg...
Each card opens the package page with its evidence and every recorded version.