
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
LocalPM is a smart package manager that prioritizes installing npm packages from your local system cache before falling back to online sources. This can significantly speed up package installation and enable offline development when possible.
You can install LocalPM globally:
npm install -g lpm
Or use it directly with npx:
npx lpm [packages...]
# Install specific packages
lpm react@17.0.2 react-dom
# Install all dependencies from package.json
lpm
# Install using a specific package manager
lpm express --package-manager yarn
# Install from a specific directory
lpm lodash --root-path /path/to/projects
Options:
--root-path, -r Custom root directory to scan for packages
--package-manager, -p Package manager to use (npm, yarn, pnpm) [default: "npm"]
--help Show help information
--version Show version number
# Install multiple packages
lpm express mongoose dotenv
# Install specific versions
lpm react@17.0.2 react-dom@17.0.2
# Use with yarn
lpm --package-manager yarn next typescript
# Scan specific directory
lpm --root-path ~/projects express
--root-path to specify a different directory to scan for packagesContributions are welcome! Please feel free to submit a Pull Request.
MIT License - feel free to use this in your own projects!
If you encounter any issues or have questions:
Thanks to all the contributors and the npm/yarn/pnpm teams for their amazing work!
FAQs
Local Package Manager - Install npm packages from your local system cache
We found that local-pm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.