Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 6
643 packages with an LPM warning, newest scan first. Showing 241–288.
The bundle sends identifying account and developer details to the vendor's telemetry endpoint during runtime, making this undisclosed telemetry a real privacy risk. The reported credentia...
The package has a plausible error-reporting purpose, but its undisclosed runtime telemetry can forward a player URI containing article and consent data to Sentry. This warrants a warning...
The package only loads reporting interfaces when the user selects an upload option, but those interfaces include the local username and Git metadata in the uploaded benchmark data. Since...