CVE-2026-71460

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

Malicious code in eslint-plugin-i18n-shreddit (npm)

Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.js' that runs automatically on npm install. index.js collec...

MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

Malicious code in eslint-config-compact-utils (npm)

Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working directory together with CI/repository environment variables...

Malicious code in n8n-nodes-data-transformer-utils (npm)

Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocations to collect host information including reads of /etc/hos...

CVE-2026-71460: Missing Authorization

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

Malicious code in eslint-config-compact-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working...

MAL-2026-16417 Malicious code in eslint-config-compact-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working...

Malicious code in cisco-github-simple (npm)

Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the installer — os.hostname, os.userInfo.username, home...

Malicious code in take-home-caller-id (npm)

Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads homedir, DNS server list, and cwd, and reads /etc/passwd a...

MAL-2026-16382 Malicious code in take-home-caller-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...

MAL-2026-16381 Malicious code in cisco-github-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...

Malicious code in catwrestlingbird (npm)

Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release,...

Malicious code in starbucks-sdk (npm)

Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo, os.platform, the current working directory, and a timestamp, then...

Malicious code in action-slack-message-root (npm)

Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname, os.platform, os.arch, os.release, os.uptime, os.cpus,...

Malicious code in @siriusbeyond/utils (npm)

Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects host reconnaissance hostname, username, platform, cwd, home...

Malicious code in bulk-add-sdk (npm)

Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP...