npm scope
@zmtcdn
LPM Firewall blocks 2 packages in the @zmtcdn npm scope. 2 have LPM's own review and are listed first.
Oct 28, 2026
@zmtcdn/components@9999.0.0
Data exfiltrationThe manifest activates a postinstall hook that automatically discloses identifying host and user metadata to a fixed external collector. This is an installation beacon and warrants blocki...
Oct 28, 2026
@zmtcdn/ui@9999.0.7
Install hook abuseThe manifest activates a postinstall hook that sends identifying host and user data to a fixed external endpoint. This is automatic installation-time disclosure without installer consent,...
Each card opens the package page with its evidence and every recorded version.