Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 2
643 packages with an LPM warning, newest scan first. Showing 49–96.
The package automatically sends runtime callback telemetry, including an OAuth code prefix, to the configured auth service, with no apparent opt-out. This is a telemetry concern rather th...
The source shows runtime telemetry beyond the hardware and visit tracking described in the README: the default prospect tracker watches contact clicks and transmits page and contact detai...
The browser bundle includes default PostHog telemetry for runframe activity and UI errors, with an opt-out but no disclosure in the package README. This is an undisclosed runtime collecti...