Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 13
651 packages with an LPM warning, newest scan first. Showing 577–624.
A transitive dependency documents and implements sampled runtime telemetry that reports the page hostname and site key to Prosopo for self-hosted widgets. Because the package README says...
The explicit agent connection command installs hooks that transmit tool inputs and outputs, but its setup flow does not clearly disclose that content collection. This warrants a warning f...