period-newline (npm): malicious package compromises any machine where it is installed; no safe version exists
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub published advisory GHSA-39vr-m6q2-vq5c on 2026-11-10 flagging the npm package period-newline as malware (CWE-506, embedded malicious code). Every version (= 0) is affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. Removal of the package does not guarantee removal of the malicious software. All npm users who installed period-newline are affected; the remediation is full incident response, not a version upgrade.
What to do
- Treat any machine with period-newline installed as fully compromised; isolate and rebuild from clean images
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a different computer
- Remove the package from all projects, lockfiles, and CI pipelines and audit for persistence mechanisms
- Review npm dependency trees and CI logs for other installs of the package and any post-install activity
- Block the package name in internal registries and dependency scanning
Sources
All live incidents on Threat Watch
