---
id: 2026-10-local-commander-agent-npm-0-3-52-malware-record-remove-and-rotate
title: "local-commander-agent npm 0.3.52 flagged as malware: remove it and rotate credentials on the machine it controlled"
kind: malicious-artifact
date_disclosed: 2026-10-31
last_updated: 2026-11-01
severity: high
status: unconfirmed
ecosystems: [npm, mcp]
tools_affected: ["local-commander-agent 0.3.52 (npm), the local agent for the Local Commander MCP remote-control service used from ChatGPT, Claude, Cursor or any MCP client"]
tags: [supply-chain, malicious-package, mcp, remote-control-agent, npm, ghsa-malware, osv-mal, unconfirmed]
---

## TL;DR

Remove `local-commander-agent` 0.3.52 from any machine that installed it, and treat the credentials, sessions and files on that machine as exposed. The flag comes from one registry-side record and no researcher has published an analysis, so this file is `unconfirmed`; the publisher kept releasing after the flagged version and those later versions were not analysed here.

## Packages and versions

| Ecosystem | Name | Bad versions | Clean version or action | Registry state (date checked) | Record |
|---|---|---|---|---|---|
| npm | `local-commander-agent` | 0.3.52 (published 2026-10-23 14:37 UTC) | remove; no version is confirmed clean by any record; 0.3.53 to 0.3.61 (2026-10-25 to 2026-10-31) were published by the same maintainer after the flagged version and are not covered by the record | 0.3.52 returns 404 at `registry.npmjs.org/local-commander-agent/0.3.52`; the package itself is still live with 57 versions and `latest` 0.3.61 (2026-11-01) | GHSA-7j62-5j84-72fv (GitHub Advisory Database, published and reviewed 2026-10-31, CWE-506, "Malware in local-commander-agent", affected = 0.3.52, no patched version); MAL-2026-18425 (OSV, published 2026-10-31 07:57 UTC, origin `ghsa-malware`) |

What the package is: the npm description reads "Agent for Local Commander: remote control of your Windows, Mac and Linux computers from ChatGPT, Claude, Cursor or any MCP client", homepage `localcmd.app`, maintainer `netbka`, first published 2026-10-02, 2,018 downloads in the week of 2026-10-23 to 10-29. It is by design a process that lets an MCP client run commands on the host, which is why one flagged version matters more than its download count: the agent runs with the user's rights on a developer machine.

## Am I affected?

```bash
npm ls -g local-commander-agent 2>/dev/null; npm ls local-commander-agent 2>/dev/null
grep -rn '"local-commander-agent"' package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null
ls ~/.npm/_npx/*/node_modules/local-commander-agent 2>/dev/null
```

- A resolved version of exactly 0.3.52, or an `npx` cache entry for it, means the flagged version was installed; a `postinstall` or first run on or after 2026-10-23 14:37 UTC is in scope.
- Check the MCP client configuration (`~/.claude.json`, `~/.cursor/mcp.json`, `claude_desktop_config.json`) for a `local-commander-agent` entry and the date it was added.
- Other versions: no record covers them, which is not the same as clean. Decide on the publisher's account, not the record.

## If you are affected

1. Remove the package and its MCP client entry; stop any running agent process.
2. Rotate what a process running as you could read: SSH keys, cloud CLI credentials, npm and GitHub tokens, AI provider keys in the environment or in agent configuration files, browser and messaging sessions.
3. Follow [if an MCP server was malicious](../playbooks/if-an-mcp-server-was-malicious.md) and [if you installed a bad npm package](../playbooks/if-you-installed-a-bad-npm-package.md).

## Prevention

- Treat a remote-control agent for your own machine as the highest-privilege dependency you have, and pin it to a version you have reviewed. See [MCP hygiene](../prevention/mcp-hygiene.md) and [package vetting checklist](../prevention/package-vetting-checklist.md).

## Sources

- [GitHub Advisory Database — GHSA-7j62-5j84-72fv: Malware in local-commander-agent](https://github.com/advisories/GHSA-7j62-5j84-72fv) — fetched 2026-11-01: npm, affected = 0.3.52, no patched version, CWE-506, published and reviewed 2026-10-31, no named publisher.
- [OSV — MAL-2026-18425](https://api.osv.dev/v1/vulns/MAL-2026-18425) — queried 2026-11-01: published 2026-10-31 07:57 UTC, modified 08:30 UTC, affected 0.3.52, origin `ghsa-malware`, reference to the GHSA; no credits.
- [npm registry — local-commander-agent](https://registry.npmjs.org/local-commander-agent) — queried 2026-11-01: description, maintainer, homepage, `time` entries for 0.3.50 to 0.3.61, `dist-tags`, 57 versions; the per-version URL for 0.3.52 returned 404.
- [npm downloads API — local-commander-agent, last week](https://api.npmjs.org/downloads/point/last-week/local-commander-agent) — queried 2026-11-01: 2,018 downloads, 2026-10-23 to 2026-10-29.