Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519 public key labeled pwn@kali to...

Malicious code in vend-utilities (npm)

Source: amazon-inspector 89ed34c4d09a0f8bb373f141d18157203eb73efec9461434a7957dfe17ba72f1 package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer host identity os.hostname, os.userInfo including uid/gid/shell/homedir,...