Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 6
453 packages with LPM's own review, newest scan first. Showing 241–288.
Source directly establishes off-device transmission of an Azure bearer token to a hard-coded endpoint. The absence of an install hook limits automatic exposure but does not neutralize cre...
The hard-coded non-package gateway is automatically selected and receives authentication and database credential material. The lack of installation hooks limits the trigger but does not r...
This is concrete credential exfiltration to a package-controlled third-party endpoint, activated by the package's core login flow. The automatic project-level updater increases supply-cha...