Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 14
651 packages with an LPM warning, newest scan first. Showing 625–651.
No malicious install-time behavior was identified. In the direct CLI failure path, telemetry sends raw error text and stack traces that may disclose local paths despite the source's state...
The reported credential flow targets Wix’s own feedback API and is gated by an explicit tool call with topic checks, so the source does not support the scanner’s claim of credential theft...
The bundled OIDC helper discloses the machine hostname and runtime details to Vercel during authentication. This is a narrow runtime privacy concern, not evidence of credential theft or u...