MAL-2026-13890 Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7 The package's postinstall script callback.js and its declared main entrypoint index.js contain byte-identical dropper code that runs on npm install a...

MAL-2026-13914 Malicious code in @years20/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7 The package auto-executes a reconnaissance and exfiltration payload both at install via scripts.postinstall running callback.js and on require...

Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and relat...

Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571 package.json postinstall runs callback.js, and index.js declared main is byte-identical, so both npm install and any require of the package trigger t...

MAL-2026-13892 Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...

MAL-2026-13894 Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

MAL-2026-13897 Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

MAL-2026-13896 Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

MAL-2026-13899 Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

MAL-2026-13898 Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

MAL-2026-13903 Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69298edbeb56ed182ba1b98c575c24b9ac53138a0a2cadfd9fd3dbbf3e637546 The package's postinstall script callback.js and its main entry point index.js, byte-identical execute automatically on npm install and on...

Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

MAL-2026-13912 Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP...

MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...