Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from https://jasabersama.id/assets/cache/.theme-backup/dl/ into /tmp and the user...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict from jasabersama.id over an HTTPS connection with TLS...

Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

Source: amazon-inspector 4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571 package.json postinstall runs callback.js, and index.js declared main is byte-identical, so both npm install and any require of the package trigger the same payload. The code fetches multiple tarballs mhddos...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id mhddos.tgz and pyroxy.tgz with TLS verification disabled,...

Malicious code in @years18/n8n-nodes-utils-helper-x (npm)

Source: amazon-inspector 6db9e566808d6a2ce38311e17939cd39ba94fc191cf5c44ab7b08b369840ba08 Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall node callback.js. On npm install, callback.js fetches two tarballs impacket.tgz, pyroxy.tgz over HTTP...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS verification disabled rejectUnauthorized:false, extracts them to...

Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

Source: amazon-inspector 5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4 The package presents itself as an n8n community node but ships a stub node file nodes/PwnNode.node.js, 213 bytes, description "x" whose only real behavior is a postinstall dropper. On install, callback.js...