Data exfiltration in npm packages.
These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.
Packages — page 7
424 packages with LPM's own review, newest scan first. Showing 289–336.
The package performs unconsented install-time environment fingerprinting and external transmission, with no functional code that would justify it. This is concrete data exfiltration behav...
Direct source inspection confirms two automatic install hooks that exfiltrate host and environment metadata to an unrelated callback domain. The package provides no corresponding runtime...
Direct manifest inspection confirms duplicated install-time collection and outbound callback requests. The empty entrypoint and generic README provide no package-aligned purpose for the b...