Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13880 Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

MAL-2026-13873 Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

MAL-2026-13876 Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5 The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key tagged pwn@kali to authorizedkeys for root...

MAL-2026-13878 Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5 The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key tagged pwn@kali to authorizedkeys for root...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13874 Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13850 Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

MAL-2026-13851 Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...

Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...

Malicious code in @years18/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df58050e02ff53c728a303196575150af9e64959761f10079284077b1c274572 On npm install, the package's postinstall hook callback.js / index.js executes shell commands including id and hostname, probes the internal RFC1918...

MAL-2026-13852 Malicious code in @years18/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df58050e02ff53c728a303196575150af9e64959761f10079284077b1c274572 On npm install, the package's postinstall hook callback.js / index.js executes shell commands including id and hostname, probes the internal RFC1918...

MAL-2026-13860 Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id...