Credential exfiltration in npm packages.
These packages collect secrets such as npm tokens, cloud keys, SSH keys, environment variables or local credential files and send them to a destination the user did not authorize.
Packages — page 7
453 packages with LPM's own review, newest scan first. Showing 289–336.
The sole package behavior is an install-time cloud-metadata collection and external transmission chain, with no package functionality to justify it.
The sole package behavior is an unconsented postinstall metadata fetch followed by external transmission. This is a concrete credential/data-exfiltration chain, not a benign package feature.
Direct source inspection confirms an install-time HTTPS exfiltration chain. The package has no apparent functional implementation beyond collecting and transmitting host data.