MAL-2026-13886 Malicious code in @years19/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e8eda8f141799c4f6f587dbf9771f07e86f64abac9d161319e19b3f836a7fde The npm package's postinstall script callback.js resolves the user's Python site-packages directory and downloads a tarball from...

Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7 The package's postinstall script callback.js and its declared main entrypoint index.js contain byte-identical dropper code that runs on npm install a...

MAL-2026-13890 Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7 The package's postinstall script callback.js and its declared main entrypoint index.js contain byte-identical dropper code that runs on npm install a...

MAL-2026-13909 Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc The package's postinstall script callback.js and its main module index.js, byte-identical to callback.js execute on both npm install and require. The...

MAL-2026-13910 Malicious code in @years20/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60 On npm install postinstall and on require/import of the package's main entry, callback.js and index.js execute id, hostname, and WSL detection, read...

Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and relat...

MAL-2026-13891 Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and relat...

MAL-2026-13893 Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571 package.json postinstall runs callback.js, and index.js declared main is byte-identical, so both npm install and any require of the package trigger t...

Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...

Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

MAL-2026-13894 Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

MAL-2026-13895 Malicious code in @years19/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16 The package's postinstall script and its main entrypoint index.js, byte-identical to callback.js fetch four tarballs mhddos, PyRoxy, impacket,...

Malicious code in @years19/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16 The package's postinstall script and its main entrypoint index.js, byte-identical to callback.js fetch four tarballs mhddos, PyRoxy, impacket,...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and...

MAL-2026-13901 Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and...

MAL-2026-13898 Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69298edbeb56ed182ba1b98c575c24b9ac53138a0a2cadfd9fd3dbbf3e637546 The package's postinstall script callback.js and its main entry point index.js, byte-identical execute automatically on npm install and on...

MAL-2026-13903 Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69298edbeb56ed182ba1b98c575c24b9ac53138a0a2cadfd9fd3dbbf3e637546 The package's postinstall script callback.js and its main entry point index.js, byte-identical execute automatically on npm install and on...