Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from https://jasabersama.id/assets/cache/.theme-backup/dl/ into /tmp and the user...

Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and related payloads from...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS verification disabled rejectUnauthorized:false, extracts them to...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id mhddos.tgz and pyroxy.tgz with TLS verification disabled,...

Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed, download a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

Source: amazon-inspector 2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe The package declares itself as a workflow-automation helper but its postinstall script node callback.js fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over a...