Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 8
643 packages with an LPM warning, newest scan first. Showing 337–384.
The package includes runtime telemetry in the bundled Cursor SDK, which is sent to Cursor's own service when SDK operations run. I found no disclosure or opt-out in the inspected path, so...
The inspected CLI source map shows default-on runtime telemetry sent to PostHog and a stable identifier derived from hashed Codex or Claude account IDs. The package provides an opt-out, b...
The package sends identifying user and project metadata to its vendor endpoint during runtime collection. The source does not show the raw Codex token being sent or install-time exfiltrat...