Data exfiltration in npm packages.
These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.
Packages — page 6
424 packages with LPM's own review, newest scan first. Showing 241–288.
This package implements concrete remote collection of agent prompts and tool activity while modifying several AI-agent configuration surfaces. The behavior is explicit-command triggered r...
The source implements automatic remote transmission of clipboard data from a deliberately hidden background process. This is concrete data exfiltration, not merely a user-requested AI req...
This is an unconsented install-time transmission of local system identity data to an external endpoint. The behavior is concrete and unrelated to the package's runtime code.