Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint index.js that fire on npm install and on module load. The scrip...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in the postinstall lifecycle script: it collects host identi...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

MAL-2026-13913 Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

MAL-2026-13874 Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out to install pip from /tmp/get-pip.py, then installs...

MAL-2026-13851 Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...