Data exfiltration in npm packages.
These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.
Packages — page 2
424 packages with LPM's own review, newest scan first. Showing 49–96.
The runtime exporter has a publisher-selected private-network default that does not match its OpenAI tracing description, and its request sends serialized traces containing conversation i...
The postinstall hook performs an automatic transfer of host-identifying data to an external endpoint. That establishes a concrete data exfiltration attack surface even though the inspecte...
Source inspection confirms that ordinary MCP use automatically uploads project file excerpts by default, contrary to the package’s stated manual-only behavior. This is concrete runtime da...