Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 7
643 packages with an LPM warning, newest scan first. Showing 289–336.
The package enables runtime telemetry by default and the README does not disclose it, which meets the warning criteria for undisclosed runtime telemetry. The destination and complete payl...
The package’s explicit `init` flow sends authenticated installation and usage telemetry to the publisher’s service, including stable project-derived identifiers, with no disclosure or opt...
Version 0.5.1 automatically sends runtime command-usage telemetry to the package’s relay, and the CLI offers no opt-out. The data is limited to usage metrics, so this warrants a warning r...