@rutxploit-sec
LPM Firewall blocks 10 packages in the @rutxploit-sec npm scope. 10 have LPM's own review and are listed first.
The preinstall hook unconditionally exfiltrates hostname and username to a listener and suppresses errors, which is concrete install-time data collection. A loopback URL and bug-bounty wo...
Automatic install-time host-identifier transmission to an external IP is a concrete data-exfiltration behavior. The duplicated import-time request reinforces that this is active behavior...
The package contains concrete, automatic install-hook data collection and transmission. Its loopback destination does not remove the unconsented collection behavior or the risk from a loc...
The automatic lifecycle hook gathers and transmits host identity data, while the package metadata explicitly frames the behavior as dependency confusion. This is concrete malicious instal...
The preinstall hook unconditionally harvests hostname and username and sends them over HTTP during install, with errors silenced, while presenting the package as @waves/icons. Self-descri...
The package contains a concrete preinstall data-collection and HTTP-send operation. Automatic execution during installation makes this malicious install-time behavior.
The package contains an automatic preinstall hook that harvests machine identity fields and sends them over HTTP. This is concrete install-hook abuse and is not necessary for the declared...
Automatic collection and transmission of host identity data during preinstall is concrete install-hook abuse. The package's dependency-confusion framing reinforces malicious intent.
This package contains an active preinstall payload intended to run when a dependency-confusion target installs it. The automatic collection and network action make this a blockable instal...
The package contains an automatic preinstall hook that collects and sends local identifiers. This is concrete install-hook abuse, not required behavior for the declared module.