local-commander-agent npm 0.3.52 flagged as malware: remove it and rotate credentials on the machine it controlled

View raw markdownEdit on GitHub ↗

TL;DR

Remove local-commander-agent 0.3.52 from any machine that installed it, and treat the credentials, sessions and files on that machine as exposed. The flag comes from one registry-side record and no researcher has published an analysis, so this file is unconfirmed; the publisher kept releasing after the flagged version and those later versions were not analysed here.

Packages and versions

Ecosystem Name Bad versions Clean version or action Registry state (date checked) Record
npm local-commander-agent 0.3.52 (published 2026-10-23 14:37 UTC) remove; no version is confirmed clean by any record; 0.3.53 to 0.3.61 (2026-10-25 to 2026-10-31) were published by the same maintainer after the flagged version and are not covered by the record 0.3.52 returns 404 at registry.npmjs.org/local-commander-agent/0.3.52; the package itself is still live with 57 versions and latest 0.3.61 (2026-11-01) GHSA-7j62-5j84-72fv (GitHub Advisory Database, published and reviewed 2026-10-31, CWE-506, "Malware in local-commander-agent", affected = 0.3.52, no patched version); MAL-2026-18425 (OSV, published 2026-10-31 07:57 UTC, origin ghsa-malware)

What the package is: the npm description reads "Agent for Local Commander: remote control of your Windows, Mac and Linux computers from ChatGPT, Claude, Cursor or any MCP client", homepage localcmd.app, maintainer netbka, first published 2026-10-02, 2,018 downloads in the week of 2026-10-23 to 10-29. It is by design a process that lets an MCP client run commands on the host, which is why one flagged version matters more than its download count: the agent runs with the user's rights on a developer machine.

Am I affected?

npm ls -g local-commander-agent 2>/dev/null; npm ls local-commander-agent 2>/dev/null
grep -rn '"local-commander-agent"' package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null
ls ~/.npm/_npx/*/node_modules/local-commander-agent 2>/dev/null
  • A resolved version of exactly 0.3.52, or an npx cache entry for it, means the flagged version was installed; a postinstall or first run on or after 2026-10-23 14:37 UTC is in scope.
  • Check the MCP client configuration (~/.claude.json, ~/.cursor/mcp.json, claude_desktop_config.json) for a local-commander-agent entry and the date it was added.
  • Other versions: no record covers them, which is not the same as clean. Decide on the publisher's account, not the record.

If you are affected

  1. Remove the package and its MCP client entry; stop any running agent process.
  2. Rotate what a process running as you could read: SSH keys, cloud CLI credentials, npm and GitHub tokens, AI provider keys in the environment or in agent configuration files, browser and messaging sessions.
  3. Follow if an MCP server was malicious and if you installed a bad npm package.

Prevention

  • Treat a remote-control agent for your own machine as the highest-privilege dependency you have, and pin it to a version you have reviewed. See MCP hygiene and package vetting checklist.

Sources