MAL-2026-13853 Malicious code in @years18/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16d7ce451e7cdf1d3486a22c2ec25e3f56651ce45e132178839e2283918183f The package's postinstall script callback.js and its declared main entry index.js, byte-identical to callback.js fetch a tarball and a get-pip...

Malicious code in @years18/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16d7ce451e7cdf1d3486a22c2ec25e3f56651ce45e132178839e2283918183f The package's postinstall script callback.js and its declared main entry index.js, byte-identical to callback.js fetch a tarball and a get-pip...

MAL-2026-13856 Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fea406c4c8f2da771cb9d9fd8cba41c74520a876454ab9875fbba17c339966d The package's postinstall script callback.js and its main module index.js, loaded on require are byte-identical droppers. On install and on load they...

Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

MAL-2026-13849 Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53 The package's declared postinstall script node callback.js and its main entrypoint index.js contain identical payloads that fire on npm install and...

MAL-2026-13858 Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98 The package's postinstall script callback.js and its declared main index.js both fetch two tarballs from...

Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98 The package's postinstall script callback.js and its declared main index.js both fetch two tarballs from...

Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

MAL-2026-13861 Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install, downloads a tarball from...

MAL-2026-13865 Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df The package's postinstall script duplicated as the main module runs unconditionally on npm install. It executes id and hostname, base64-encodes the...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

MAL-2026-13863 Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...

Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...

MAL-2026-13866 Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f The package masquerades as an n8n community node name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' descriptio...

Malicious code in @years18/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db9e566808d6a2ce38311e17939cd39ba94fc191cf5c44ab7b08b369840ba08 Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall node callback.js. On npm install, callback....

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...