Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

Malicious code in @years20/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...

Malicious code in envpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. T...

Malicious code in kit-map-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check...

Malicious code in @years19/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b Package presents itself as an n8n community utility node, but the shipped node file nodes/PwnNode.node.js is a 213-byte stub. The real behavior is in...

Malicious code in @years19/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120 The package's postinstall scripts.postinstall: node callback.js collects host identity and environment fingerprint output of id, hostname, Python...

Malicious code in @years18/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1342694c7cf44fdd451ec464ebcee8acca8523770f147805b8b3c4a7ae225fa The package's postinstall hook node callback.js fetches three tarballs mhddos, pyroxy-full, impacket from...

Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e The package advertises itself as an n8n utility helper and registers a trivial stub node nodes/PwnNode.node.js, but its postinstall lifecycle script...

Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node nodes/PwnNode.node.js is a 213-byte stub with no...

Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

Malicious code in @years19/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e8eda8f141799c4f6f587dbf9771f07e86f64abac9d161319e19b3f836a7fde The npm package's postinstall script callback.js resolves the user's Python site-packages directory and downloads a tarball from...

Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7 The package's postinstall script callback.js and its declared main entrypoint index.js contain byte-identical dropper code that runs on npm install a...

Malicious code in @years20/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faf7b80781cbd76ad24c149a065fbcdd3d75cff7911b0225a540b0f358c35570 On npm install, callback.js/index.js invoked from the package's postinstall/main executes id and hostname, reads /etc/ssh/sshhosted25519key.pub,...

Malicious code in @years20/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc The package's postinstall script callback.js and its main module index.js, byte-identical to callback.js execute on both npm install and require. The...

Malicious code in @years20/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60 On npm install postinstall and on require/import of the package's main entry, callback.js and index.js execute id, hostname, and WSL detection, read...

Malicious code in @years20/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7 The package auto-executes a reconnaissance and exfiltration payload both at install via scripts.postinstall running callback.js and on require...

Malicious code in @years19/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755 On install, callback.js also present as index.js and wired as the postinstall hook downloads four Python tarballs mhddos, PyRoxy, impacket, and relat...

Malicious code in @years19/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571 package.json postinstall runs callback.js, and index.js declared main is byte-identical, so both npm install and any require of the package trigger t...

Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...

Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

Malicious code in @years19/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16 The package's postinstall script and its main entrypoint index.js, byte-identical to callback.js fetch four tarballs mhddos, PyRoxy, impacket,...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and...

Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69298edbeb56ed182ba1b98c575c24b9ac53138a0a2cadfd9fd3dbbf3e637546 The package's postinstall script callback.js and its main entry point index.js, byte-identical execute automatically on npm install and on...

Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282 The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on...

Malicious code in @years19/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5 The package's postinstall hook callback.js and its declared main entry index.js, byte-identical to callback.js both write a Python script to...

Malicious code in @years19/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2955ed4843fe66495bbe53420b28e91530f48facae3aea0a9c3719676c30c0a5 The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600...

Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP...

Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b package.json declares preinstall: node index.js, which runs automatically on npm install. index.js shells out via childprocess and curl to POST the...

Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

Malicious code in @years17/n8n-nodes-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64819454fc9d9904917336a6e36102f0925718ad2f4eab2d6673d75ff68fe777 Package ships a malicious n8n community node with three independent installer-harm paths. 1 package.json declares a postinstall script that shells ou...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5 The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key tagged pwn@kali to authorizedkeys for root...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8 The package's postinstall script duplicated in index.js runs automatically on npm install and performs three malicious actions: 1 executes...