Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 10
453 packages with LPM's own review, newest scan first. Showing 433–453.
Source inspection confirms a concrete browser-time remote-code and traffic-proxy chain, despite no npm install hook. Obfuscation and bundled proxy infrastructure make the behavior materia...
Direct inspection of the sole package file confirms an automatic install-time AWS credential-exfiltration chain. This is concrete malicious behavior, not a scanner-only inference.
Direct source inspection confirms import-time exfiltration in both package entrypoints to a non-package-aligned domain, including full environment variables. This is concrete malicious be...