Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall collects id/hostname, docker socket state, sudo -n -l, docker p...

Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, docker socket probe, appends a hardcoded attacker ssh-ed25519...

Malicious code in @years19/n8n-nodes-utils-helper-s (npm)

Source: amazon-inspector 2955ed4843fe66495bbe53420b28e91530f48facae3aea0a9c3719676c30c0a5 The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds — and launches it in the background via nohup...

Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

Source: amazon-inspector a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node nodes/PwnNode.node.js is a 213-byte stub with no functionality. The postinstall hook — duplicated in the ma...

Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node nodes/PwnNode.node.js is a 213-byte stub with no...

MAL-2026-13885 Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node nodes/PwnNode.node.js is a 213-byte stub with no...

Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc The package's postinstall script callback.js and its main module index.js, byte-identical to callback.js execute on both npm install and require. The...

MAL-2026-13914 Malicious code in @years20/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7 The package auto-executes a reconnaissance and exfiltration payload both at install via scripts.postinstall running callback.js and on require...

Malicious code in @years20/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7 The package auto-executes a reconnaissance and exfiltration payload both at install via scripts.postinstall running callback.js and on require...

MAL-2026-13881 Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

MAL-2026-13880 Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

MAL-2026-13869 Malicious code in @years17/n8n-nodes-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64819454fc9d9904917336a6e36102f0925718ad2f4eab2d6673d75ff68fe777 Package ships a malicious n8n community node with three independent installer-harm paths. 1 package.json declares a postinstall script that shells ou...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

MAL-2026-13872 Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

MAL-2026-13870 Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

MAL-2026-13876 Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...