MAL-2026-13920 Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...

MAL-2026-13916 Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...

Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...

MAL-2026-13918 Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...

MAL-2026-13919 Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

Malicious code in @years20/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

MAL-2026-13888 Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

Malicious code in @years19/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120 The package's postinstall scripts.postinstall: node callback.js collects host identity and environment fingerprint output of id, hostname, Python...

Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e The package advertises itself as an n8n utility helper and registers a trivial stub node nodes/PwnNode.node.js, but its postinstall lifecycle script...

MAL-2026-13884 Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e The package advertises itself as an n8n utility helper and registers a trivial stub node nodes/PwnNode.node.js, but its postinstall lifecycle script...

MAL-2026-13885 Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node nodes/PwnNode.node.js is a 213-byte stub with no...

Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

MAL-2026-13887 Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

Malicious code in @years19/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e8eda8f141799c4f6f587dbf9771f07e86f64abac9d161319e19b3f836a7fde The npm package's postinstall script callback.js resolves the user's Python site-packages directory and downloads a tarball from...

Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7 The package's postinstall script callback.js and its declared main entrypoint index.js contain byte-identical dropper code that runs on npm install a...

Malicious code in @years20/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faf7b80781cbd76ad24c149a065fbcdd3d75cff7911b0225a540b0f358c35570 On npm install, callback.js/index.js invoked from the package's postinstall/main executes id and hostname, reads /etc/ssh/sshhosted25519key.pub,...

MAL-2026-13909 Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc The package's postinstall script callback.js and its main module index.js, byte-identical to callback.js execute on both npm install and require. The...