local-config-parser
Advanced tools
The fragment implements a rules engine that executes configuration-provided “expression” strings as JavaScript using Node’s vm. Because the expressions are sourced from JSON files in a user-derived, typically writable directory (APPDATA/home) and because it auto-executes cached rules during module import, an attacker who can modify the relevant config/cache file could trigger untrusted code execution (or at minimum unintended logic/DoS) within the application’s trust boundary. There is no direct evidence of overt malware behaviors like exfiltration or persistence in this snippet, but the dynamic execution pattern is security-sensitive and should be hardened (e.g., remove auto-exec, validate/sign configs, and restrict to a real expression DSL or a strictly locked-down sandbox). The remote content is malicious and gets downloaded by another package that is installed in the same dependency chain. The malicious content implements sandbox-escape logic and perform downloader logic that runs next stage malware samples.
This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
Please refer to www.npmjs.com/advisories?search=local-config-parser for more information.
FAQs
security holding package
The npm package local-config-parser receives a total of 2 weekly downloads. As such, local-config-parser popularity was classified as not popular.
We found that local-config-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.
Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
