MAL-2026-13894 Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

MAL-2026-13898 Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282 The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on...

MAL-2026-13905 Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282 The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on...

Malicious code in @years19/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5 The package's postinstall hook callback.js and its declared main entry index.js, byte-identical to callback.js both write a Python script to...

Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

MAL-2026-13912 Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

MAL-2026-13908 Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

MAL-2026-13881 Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13880 Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

MAL-2026-13873 Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

MAL-2026-13876 Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5 The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key tagged pwn@kali to authorizedkeys for root...