Is there a special case for a player named "newplayer"? I run an offline server, and if i login with uername "newplayer", pex sort of works (i finally got it to assign the default group correctly), but the user still has permissions for fly and heal and who knows what else. i tried another random username "another" and permissions/group worked properly as expected. i was forced to ban the username "newplayer". If i ever go open to the internet, I'm concerned with some random username getting superuser/op rights.

Offline servers are not supported by PEX. (And, as a matter of fact, offline mode is what hackers and others who download illegal copies of Minecraft need, which adds another reason it's not supported by PEX.)