Malicious npm package local-commander-agent 0.3.52 fully compromises hosts
Severity: critical · Patch status: no-fix-needed · Since 2026-10-31
GitHub's advisory database published a malware advisory (GHSA-7j62-5j84-72fv) for the npm package local-commander-agent, affecting version 0.3.52. The package is classified as embedded malicious code (CWE-506) and grants attackers full control of any computer where it is installed or running, meaning all secrets and keys on affected machines must be considered compromised. No patched version exists and no known source code is available. Any environment that installed this package should be treated as fully compromised; removal of the package alone cannot be assumed to eliminate all malicious software planted during installation.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean computer
- Remove local-commander-agent 0.3.52 from all projects and lockfiles
- Rebuild or wipe affected machines; do not assume removal removes all malicious software
- Audit systems for signs of compromise and review access logs
- Block the package in dependency firewalls/CI and check dependency trees for it
Sources
All live incidents on Threat Watch
