Which versions of line-through are malicious?

The following npm versions of line-through are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate line-through if I installed it?

line-through is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed line-through — how do I know if it already compromised me?

If line-through was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is line-through part of a known attack campaign?

Yes — line-through is associated with the IN-MAL-2026-019633 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find line-through across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for line-through (version 1.0.0).

Malicious package

line-throughnpm

Advisory published Sep 4, 2026Updated Sep 4, 2026

line-through is a confirmed malicious npm package (MAL-2026-15923) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in line-through (npm)

MAL-2026-15923

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall line-through

What this malware does

The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP (via api.ipify.org), OS hostname, and GitHub Actions / CI environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, and related identifiers), then sends them as query parameters in an HTTPS GET to a hardcoded collector at https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d. It also performs a DNS lookup encoding the hostname as a subdomain of an out-of-band collaborator domain (left as the placeholder your-collab-domain.oastify.com). Behavior fires automatically on npm install with no user interaction.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for line-through (version 1.0.0).
If you installed it — respond
line-through is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If line-through was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. line-through on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-019633

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks line-through-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database