Malicious npm package modules-newline — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published a malware advisory (GHSA-5hjr-7qfq-x5m5) for the npm package modules-newline, flagged as CWE-506 embedded malicious code. All versions (= 0) are affected and no patched version exists; the package has no known source code repository and receives roughly 66 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants outside actors full control of the host. Anyone who installed the package is affected. There is no fix — remediation consists of removing the package, rotating all secrets and keys from a clean machine, and rebuilding/reimaging affected systems, since removal cannot guarantee all malicious software is eliminated.
What to do
- Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer
- Remove modules-newline from all projects and lockfiles and block it in dependency policies
- Reimage or rebuild affected machines; do not assume removal fully cleans the system
- Audit systems for persistence, unauthorized access, and exfiltration indicators
- Check CI/CD and developer environments for the package and any credentials they hold
Sources
All live incidents on Threat Watch
