Supply chain · npm · High

Critical npm package 'local-config-parser' identified as malware

Threat Engine Auto-Feed · data current as of 2026-07-28

The npm package 'local-config-parser' has been identified as malware, leading to full system compromise upon installation. All systems that have installed this package should be considered compromised, requiring immediate secret rotation and thorough remediation.

  • Package: npm / local-config-parser
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~1/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'local-config-parser' contains malicious code. Any system that installs or runs this package is considered fully compromised, indicating an attacker has gained complete control.

How the attack works

This is a malicious package attack where a seemingly benign or useful software component is embedded with harmful code. When integrated into a project and executed, it can grant an attacker unauthorized access and control over the host system, often exfiltrating sensitive data or establishing persistence.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull package dependencies
  • Any user or system that has 'local-config-parser' as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing installation of the latest malicious version
  • Lack of package-lock.json or similar lockfiles to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter out malicious packages
  • Automated build processes that do not vet new or updated dependencies

Blast-radius scenarios

  • An attacker gains full control over the compromised system, potentially leading to data exfiltration, further network penetration, or resource abuse.
  • All secrets and keys stored on the compromised computer are exposed and can be used by the attacker.
  • The attacker may establish persistence, making simple package removal insufficient for full remediation.

What to do (defensive)

Detect

  • Scan dependency trees for 'local-config-parser' in all projects.
  • Review package-lock.json or yarn.lock files for its presence.
  • Monitor network traffic for unusual outbound connections from development or build environments.
  • Implement software composition analysis (SCA) tools to identify known malicious packages.

Contain

  • Immediately isolate any system identified with 'local-config-parser' installed.
  • Block network access for compromised systems to prevent further exfiltration or lateral movement.
  • Suspend all CI/CD pipelines that might pull or build projects containing this package.
  • Quarantine affected code repositories to prevent further spread.

Remediate

  • Consider any system that installed 'local-config-parser' as fully compromised and rebuild from a trusted image.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from compromised systems, doing so from a different, trusted machine.
  • Thoroughly audit systems for any persistent malicious software that may have been installed beyond the package itself.
  • Remove 'local-config-parser' from all project dependencies and update lockfiles to prevent reintroduction.

Frontier verdict — High

Prioritize immediate investigation and remediation for any system that installed 'local-config-parser' due to full system compromise risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.