Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, docker socket probe, appends a hardcoded attacker ssh-ed25519...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname, whoami, /proc/1/cgroup, environment variables, /etc/os-releas...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall collects id/hostname, docker socket state, sudo -n -l, docker p...