Telemetry in npm packages.
These packages send usage, machine or identifying details, such as the hostname, email, local paths or command arguments, to their publisher or an analytics service by default. LPM Firewall warns about them, and users can choose to block them with lpm config firewall. These packages are not malware. Packages that send credentials, file contents, prompts or code, or that send data to an unrelated collector, are blocked and listed under Data exfiltration instead.
Packages — page 9
643 packages with an LPM warning, newest scan first. Showing 385–432.
The package’s report and account features are consistent with its feedback-widget purpose, and no account hijack behavior was established. However, it sends undisclosed runtime telemetry...
The flagged license-key flow serves the package's stated licensing function, and the usage ping sends only limited event fields to the vendor. Because the runtime telemetry is not disclos...
The package's on/off commands silently send action and harness telemetry to the configured router. The payload is limited and the request follows an explicit user command, but the source...