Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 5
453 packages with LPM's own review, newest scan first. Showing 193–240.
The package has a concrete install-time credential-exfiltration path. Its icon exports do not require this behavior, and the validation result is non-enforcing.
The automatic lifecycle hook exports an environment credential to a remote server. This is concrete install-time credential exfiltration, so the package should be blocked.
This icon package performs automatic preinstall credential disclosure. The hook transparently targets one named variable, but automatic export of an environment secret to a remote service...