Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 3
453 packages with LPM's own review, newest scan first. Showing 97–144.
This is concrete, unconsented install-time data exfiltration with redundant network channels. The package's research label does not neutralize the automatic behavior.
This is concrete install-time host reconnaissance and outbound exfiltration to an unrelated Telegram recipient. The automatic lifecycle hook makes the behavior unconsented.
The active package entrypoint automatically collects browser session-related data and forwards it to another endpoint. This is concrete malicious credential and data exfiltration behavior.