Malicious code in modules-newline (npm)

The modules-newline package version 0.0.6 is configured to fetch its dependency from an external HTTP URL (http://pack.nppacks.com/npm/modules-newline) rather than the official npm registry. This URL is unpinned, uses plain HTTP (vulnerable to man-in-the-middle attacks), and is hosted on a domain unrelated to npm. Consequently, any project installing this package will execute code from this external source at install time, including lifecycle scripts within the fetched tarball. The shipped index.js is almost identical to babel-plugin-transform-define but includes a comment stating it is for security research testing. This setup effectively allows arbitrary code execution during installation, representing a supply chain risk.

Projects that install modules-newline version 0.0.6, directly or transitively, risk executing arbitrary code from an untrusted external source during npm install. This can lead to compromise of the build environment or further downstream impacts depending on the executed code. The use of plain HTTP and lack of integrity verification increases the risk of man-in-the-middle attacks substituting malicious payloads.

No official patch or remediation is provided in the available data. Users should avoid installing modules-newline version 0.0.6 or any package that depends on it. Review package dependencies for references to modules-newline and remove or replace them. Consider auditing package.json files for dependencies that reference external HTTP URLs outside the official npm registry. Monitor vendor advisories for updates or fixes.