MalwarePublished 11 Aug 2026Updated 12 Aug 2026

lines-columns (npm) · Malicious Code

Affects lines-columnsSource GCVE Database

Malicious package : remove lines-columns and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13765

What to do

Remove lines-columns from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmlines-columns	Affected =1.2.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The 'lines-columns' npm package is a malicious package that closely mimics the legitimate 'lines-and-columns' package. It contains unused random-looking strings and no legitimate functionality beyond reimplementing the referenced library. Installing or running this package results in full compromise of the affected computer, requiring immediate secret and key rotation. Removal of the package does not guarantee elimination of all malicious software introduced.

Impact

Systems with the 'lines-columns' package installed or running are considered fully compromised. Attackers may have gained full control over the affected computer, risking exposure of all stored secrets and keys. Immediate rotation of all credentials is required. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Defensive guidance

Remove the 'lines-columns' package immediately. Rotate all secrets and keys stored on the affected computer from a separate, uncompromised machine. Because the system is considered fully compromised, further forensic analysis and remediation may be necessary.

Summary

The 'lines-columns' package on npm is a malicious package designed to impersonate the popular 'lines-and-columns' library. While it reimplements the legitimate functionality, it also contains suspicious unused exports with random strings. According to the GHSA malware advisory, any system with this package installed or running should be considered fully compromised. Attackers may have gained full control, and all secrets and keys stored on the system must be rotated from a different, clean machine. The package itself does not include install scripts, network I/O, or direct system access code, but the compromise risk is severe and complete.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:44 UTC

Technical details

References

Community reviews