Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 3
643 packages with an LPM warning, newest scan first. Showing 97–144.
The package’s deployer behavior matches its stated purpose, and the flagged credential paths do not show credentials sent to an unrelated host. The bundled Studio does automatically enabl...
The source shows automatic runtime analytics to PostHog with command, version and Zuplo account or user identifiers, plus a ZUPLO_DO_NOT_TRACK opt-out. The inspected package does not prov...
The bundle performs undisclosed runtime telemetry to PostHog by default, which warrants a warning under the review rules. The inspected payload contains usage and runtime fields, and no c...