MAL-2026-13847 Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe The package declares itself as a workflow-automation helper but its postinstall script node callback.js fetches a tarball from...

MAL-2026-13848 Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe The package declares itself as a workflow-automation helper but its postinstall script node callback.js fetches a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fea406c4c8f2da771cb9d9fd8cba41c74520a876454ab9875fbba17c339966d The package's postinstall script callback.js and its main module index.js, loaded on require are byte-identical droppers. On install and on load they...

MAL-2026-13856 Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fea406c4c8f2da771cb9d9fd8cba41c74520a876454ab9875fbba17c339966d The package's postinstall script callback.js and its main module index.js, loaded on require are byte-identical droppers. On install and on load they...

Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

MAL-2026-13849 Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

MAL-2026-13855 Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53 The package's declared postinstall script node callback.js and its main entrypoint index.js contain identical payloads that fire on npm install and...

MAL-2026-13857 Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53 The package's declared postinstall script node callback.js and its main entrypoint index.js contain identical payloads that fire on npm install and...

Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98 The package's postinstall script callback.js and its declared main index.js both fetch two tarballs from...

MAL-2026-13858 Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98 The package's postinstall script callback.js and its declared main index.js both fetch two tarballs from...

MAL-2026-13861 Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install, downloads a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df The package's postinstall script duplicated as the main module runs unconditionally on npm install. It executes id and hostname, base64-encodes the...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

MAL-2026-13863 Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...