Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages
641 packages with an LPM warning, newest scan first. Showing 1–48.
The CLI sends runtime analytics by default, and no disclosure of this collection was found in the inspected package documentation. The event contains ordinary usage and runtime fields, so...
The install hook and launcher behave consistently with installing and running the package’s native CLI. However, the limited binary analysis reveals Sentry crash-reporting components with...
The CLI's agent execution and local Claude credential checks fit its stated purpose. However, an unauthenticated sync can send the project's identifying domain to the vendor's telemetry e...