MAL-2026-13867 Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab This package presents itself as an n8n workflow helper but ships a near-empty node stub nodes/PwnNode.node.js, 213 bytes while its postinstall hook a...

Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab This package presents itself as an n8n workflow helper but ships a near-empty node stub nodes/PwnNode.node.js, 213 bytes while its postinstall hook a...

Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f The package masquerades as an n8n community node name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' descriptio...

MAL-2026-13866 Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f The package masquerades as an n8n community node name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' descriptio...

Malicious code in @years18/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db9e566808d6a2ce38311e17939cd39ba94fc191cf5c44ab7b08b369840ba08 Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall node callback.js. On npm install, callback....

MAL-2026-13868 Malicious code in @years18/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db9e566808d6a2ce38311e17939cd39ba94fc191cf5c44ab7b08b369840ba08 Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall node callback.js. On npm install, callback....

MAL-2026-13819 Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...

Malicious code in @noxzacode/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d51e06f0702bd125716dddf0bae250e419a3ce6b03f0faab8f64e4fde5146f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13831 Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

Malicious code in @noxzacode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3082addf9f38493a38854287a70c75981ded28e693bf391917600680276a1ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in noxleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d929b8d2b0bb5277fede1759081c008d05ea8057d8263c6148e7d61001095a This package is a fork of the Baileys WhatsApp library that wires an undocumented routine into the connection lifecycle. On every WhatsApp...

Malicious code in kanyut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75dd1fedbe6fa65ad732715731698661fbe733cc186c28634d4f0424284dcbe7 A a static rule matched on keyword co-occurrence ping, GET, id across widely separated lines in lib/Utils/generics.js. The matched tokens are...

MAL-2026-13780 Malicious code in @noxzacode/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d51e06f0702bd125716dddf0bae250e419a3ce6b03f0faab8f64e4fde5146f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13805 Malicious code in egair0810 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2778f49499126b52d7dc9bbf728ed62bc8177ea325300c7907f2a4b854436507 The package contains a single index.html file declared as the package main, presenting a fake 'Just a moment...' / Cloudflare Turnstile page with...

MAL-2026-13803 Malicious code in dzcvhfruwluwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94746f13a653388ae268279888acdb3aceabbdbc5c7444e406af0dfb6317a6d9 The package's sole shipped file is index.html, a fake 'Cloudflare Verifying...' page containing an obfuscator.io-style script that reconstructs the U...

MAL-2026-13832 Malicious code in passport811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e96b8ce5a6dee87674b66e3aad6e3cf750c6e24243dd564922ff7b68be2f48b8 [email protected] contains a single HTML file that impersonates a Cloudflare Turnstile 'Just a moment...' challenge. After the Turnstile callback...

Malicious code in airdzticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba6833f6a8babb8f543c0e8aefeb9e2f0a73b14c8e336f1efe4fb3ae5e3d5fe Package airdzticket 1.0.0 contains 2 files and shows no lifecycle scripts, network callbacks, credential access, or code-execution primitives that...

Malicious code in mnteckets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caa458e1b7c6ca828e971aa0dac44b11b2f20aaf55652235ce2a4c5ce1c4fd66 The tarball contains only package.json and index.html. package.json declares no lifecycle scripts preinstall/install/postinstall/prepare and sets mai...

Malicious code in twcvhjlksdmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b37bf3e91951e089b31d7aa6d31834fef110ba5bfc1c8c3cb09e701c9c1878 The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lifecycle hooks and sets main ...