Data exfiltration in npm packages.

These packages collect data from the machine they run on, such as host and user details, source files or clipboard contents, and send it to an outside endpoint without consent.

Packages — page 8

424 packages with LPM's own review, newest scan first. Showing 337–384.

Jul 26, 2026

crm-reportinsightserv-paypal@28.0.0

Data exfiltration

Direct source inspection confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same manifest and source pattern.

Jul 26, 2026

identityscimapiserv@28.0.0

Data exfiltration

Source directly confirms unconsented install-time host fingerprint exfiltration. The nested archive contains the same malicious manifest and script.

Jul 26, 2026

identityauthorizationserv@28.0.0

Data exfiltration

Source directly confirms unconsented install-time host fingerprinting and external exfiltration. The package description also identifies it as a dependency-confusion proof of concept.