Which versions of modules-newline are malicious?

The following npm versions of modules-newline are flagged malicious: 0.0.6. Treat any of these as compromised.

How do I remediate modules-newline if I installed it?

Remove modules-newline from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed modules-newline — how do I know if it already compromised me?

If modules-newline was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is modules-newline part of a known attack campaign?

Yes — modules-newline is associated with the IN-MAL-2026-018735 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find modules-newline across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for modules-newline (version 0.0.6).

Malicious package

modules-newlinenpm

Advisory published Aug 25, 2026Updated Aug 25, 2026

modules-newline is a confirmed malicious npm package (MAL-2026-14483) that executes malicious code on install (malicious version 0.0.6). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in modules-newline (npm)

MAL-2026-14483

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall modules-newline

What this malware does

package.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/modules-newline instead of the npm registry. On npm install, npm fetches and installs whatever tarball is currently served from that URL, bypassing registry auditing. The URL is plain HTTP (subject to MITM substitution), unpinned (no tag, commit, or integrity hash), and hosted on a non-publisher domain unrelated to npm. Any project that installs this package, directly or transitively, executes code delivered from that external endpoint at install time, including any lifecycle scripts inside the fetched tarball. The shipped index.js is a near-verbatim copy of babel-plugin-transform-define preceded by a comment stating 'This package use for Security Research Testing Purpose.', and the package name does not correspond to the copied plugin's function.

Malicious versions

1 flagged

0.0.6

Indicators of compromise (SHA-256)

4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for modules-newline (version 0.0.6).
If you installed it — respond
Remove modules-newline from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If modules-newline was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. modules-newline on npm has been identified as a malicious package (version 0.0.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-018735

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks modules-newline-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database