MAL-2026-13865 Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df The package's postinstall script duplicated as the main module runs unconditionally on npm install. It executes id and hostname, base64-encodes the...

MAL-2026-13863 Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

MAL-2026-13866 Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f The package masquerades as an n8n community node name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' descriptio...

Malicious code in @years18/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db9e566808d6a2ce38311e17939cd39ba94fc191cf5c44ab7b08b369840ba08 Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall node callback.js. On npm install, callback....

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

Malicious code in dcfarguscert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...

Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

MAL-2026-13754 Malicious code in dependencyfsdsfdsfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

EUVD-2026-55848

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

CVE-2026-48161 affects react18-use (a React 19 use hook shim). Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits that added src/install.js and wired it into postinstall, which fetched a JavaScript payload from an attacker-controlled HTTPS endpoint...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161 react18-use was vulnerable to malicious code execution via compromised commits

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48160

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...

CVE-2026-48160 react-tracked was vulnerable to malicious code execution via compromised commits

react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45, the default branch contained malicious commits 6978272a7d6ca02225cb747ea69f427512e33699 through 949f1a3d6bb1ff7d1a0dec892afd773e742627e8 that executed remote attacker-controlled code on...