Data exfiltration in npm packages.
These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.
Packages — page 5
424 packages with LPM's own review, newest scan first. Showing 193–240.
Visible source establishes automatic external transmission of licence and exception data. This is concrete data exfiltration, independent of the opaque binary components.
The package establishes a concrete default route from Codex requests to third-party endpoints and conceals a pool of provider credentials. Its limited native-build postinstall hook does n...
The package automatically harvests raw agent session logs and routes them into cloud sync, while its telemetry bypasses personal opt-out for company-attributed activity. The guarded globa...