Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 2
453 packages with LPM's own review, newest scan first. Showing 49–96.
Both package entrypoints contain a default third-party API host and code that forwards the saved application token to it. Because opening the sharing dialog triggers this transfer without...
The source establishes that an existing Plane API key is sent to a package-selected default host during ordinary CLI operations, without recipient-specific consent. This is concrete crede...
The source verifies automatic disclosure of an existing GitHub credential to the publisher-selected default endpoint during ordinary Hub authentication. This supports blocking the package...