npm scope
@pisell
LPM Firewall blocks 2 packages in the @pisell npm scope. 2 have LPM's own review and are listed first.
Oct 22, 2026
@pisell/pisellos@2.3.176
Data exfiltrationInspected source confirms that ordinary ScanOrder activity can send collected runtime records to fixed Feishu webhooks selected by default. This is active data disclosure, so the package...
Jul 26, 2026
@pisell/private-materials@3.4.136
Data exfiltrationSource inspection confirms concrete payment-related data exfiltration to hardcoded external webhook credentials. Lack of lifecycle hooks does not mitigate the runtime disclosure path.
Each card opens the package page with its evidence and every recorded version.