Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages
453 packages with LPM's own review, newest scan first. Showing 1–48.
The inspected native executable source shows a default-on transfer of saved third-party access tokens to the Reason service during worker startup. The transfer is a concrete credential di...
The active runtime sends a saved service token to a package-selected default host that is not the intended YouTrack service. The configurable URL and runtime-only trigger do not remove th...
Source inspection confirms that an Anthropic API key is sent to the package’s default Mnemom gateway during the Remote Control API-key flow, without recipient-specific consent. This concr...