Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 12
643 packages with an LPM warning, newest scan first. Showing 529–576.
The package sends anonymous, limited install telemetry automatically from its postinstall hook, with telemetry enabled by default. The disclosure and opt-out reduce the risk, but install-...
The install hook sends default-on telemetry without an install-time opt-in, which is suspicious under the review rules. The inspected event is limited to anonymous identifiers and package...
The SDK conditionally forwards runtime logs containing the page URL and structured data to a server-configured collector, with no user-facing telemetry choice apparent in the inspected co...