Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 10
651 packages with an LPM warning, newest scan first. Showing 433–480.
The package sends undisclosed runtime telemetry to the publisher’s host, although the observed events contain only package and event labels and can be disabled through environment variabl...
The package has a targeted email setup path that automatically reports identifying user and project details to a hard-coded publisher address, without separate consent. This is suspicious...
The package sends limited runtime telemetry to its own service without disclosing it in the README, which meets the suspicious telemetry criterion. License validation and rule-feed reques...