Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 4
643 packages with an LPM warning, newest scan first. Showing 145–192.
Initialization sends runtime telemetry to the configured API and the browser Origin header identifies the site using the SDK. The request is described in source, but no visible opt-out wa...
The generator’s visible purpose and configuration writes are ordinary, but it automatically sends runtime telemetry after generation without disclosure in its README. The telemetry helper...
The source shows default runtime telemetry that includes merchant and payment-session identifiers and sends it to a fixed vendor endpoint. This is suspicious telemetry, but the endpoint a...