Data exfiltration in npm packages.
These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.
Packages
421 packages with LPM's own review, newest scan first. Showing 1–48.
Source inspection confirms automatic lifecycle and import-time transmission of host and installation identifiers to a fixed external endpoint. This supports blocking the package for insta...
Source inspection confirms automatic upload of repository file contents to the package’s default dashboard host, without an explicit submission gate. The behavior supports a malicious dat...
@ory/amp configures an enabled telemetry dependency with a fixed recipient, and the dependency runs its tracker from postinstall. The automatic collection and transmission of installation...