Malicious code in @years19/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...

Malicious code in @years19/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f2ee90541bcb630e80a800d961efa8a534f59200943e7aa09c57f8d4972157f The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches multiple tarballs mhddos,...

Malicious code in @years19/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bead18d11dfd3ec4bd14bfa0e950bfa53a8bd30ed66225a3dec3b47b81e5aa16 The package's postinstall script and its main entrypoint index.js, byte-identical to callback.js fetch four tarballs mhddos, PyRoxy, impacket,...

Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcd9bc9e9217d04d7194f72655188a2a827bf5cfdb888693d98a15f2434225e4 Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinstall node callback.js, and...

Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268 On npm install, the package's postinstall script callback.js / index.js fetches mhddos, PyRoxy, impacket, and multidict tarballs from...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and...

Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

Malicious code in @years19/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69298edbeb56ed182ba1b98c575c24b9ac53138a0a2cadfd9fd3dbbf3e637546 The package's postinstall script callback.js and its main entry point index.js, byte-identical execute automatically on npm install and on...

Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282 The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on...

Malicious code in @years19/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5 The package's postinstall hook callback.js and its declared main entry index.js, byte-identical to callback.js both write a Python script to...

Malicious code in @years19/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2955ed4843fe66495bbe53420b28e91530f48facae3aea0a9c3719676c30c0a5 The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600...

Malicious code in @years20/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89d61386ef6d8694ecf5f0578b5fe77156f475f76a8e97a1b2e834821cfbe0df The package presents as an n8n community-nodes helper but ships a malicious postinstall script callback.js and a byte-identical main entrypoint...

Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

Malicious code in @years20/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8 The package runs a hostile payload both from its declared postinstall hook node callback.js and at library load via index.js, which is byte-identical...

Malicious code in @years19/n8n-nodes-utils-helper-y (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f5f361848c187cd60f9143d0bdc5d2db20a3e2fa03fe5e494697da05c4a42a The package advertises itself as an n8n community utility helper node package.json declares n8n.nodes: "nodes/PwnNode.node.js" with description...

Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP...

Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

Malicious code in verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b package.json declares preinstall: node index.js, which runs automatically on npm install. index.js shells out via childprocess and curl to POST the...

Malicious code in @assetshop/verify-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342 On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami via execSync,...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in mcp-util-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044da43e53933094b69c1436146bdea64cbc4c011e4b8a141ceea0cab19eb5c On npm install, the preinstall hook scripts/check-env.js runs a host-reconnaissance sweep — whoami, id, uname, ip/route, ss listeners and connections...

Malicious code in @years17/n8n-nodes-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64819454fc9d9904917336a6e36102f0925718ad2f4eab2d6673d75ff68fe777 Package ships a malicious n8n community node with three independent installer-harm paths. 1 package.json declares a postinstall script that shells ou...

Malicious code in @years17/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397 The package runs credential-harvesting recon both from its postinstall script and from its main entry executed at require time. The postinstall...

Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

Malicious code in @years17/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603 On npm install, the package's postinstall hook runs node callback.js with identical logic duplicated in index.js so it also fires on require. The...

Malicious code in @years17/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3 The package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key labeled pwn@kali to...

Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5 The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key tagged pwn@kali to authorizedkeys for root...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8 The package's postinstall script duplicated in index.js runs automatically on npm install and performs three malicious actions: 1 executes...

Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe The package declares itself as a workflow-automation helper but its postinstall script node callback.js fetches a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

Malicious code in @years18/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...

Malicious code in @years18/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c17b5de9890a54a8a7a1ddf14ff05488baa64612904cf577591e1b9f9a007f1a The package ships a postinstall hook node callback.js and a main entrypoint index.js, byte-identical to callback.js that both perform install-time an...

Malicious code in @years18/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df58050e02ff53c728a303196575150af9e64959761f10079284077b1c274572 On npm install, the package's postinstall hook callback.js / index.js executes shell commands including id and hostname, probes the internal RFC1918...

Malicious code in @years18/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b16d7ce451e7cdf1d3486a22c2ec25e3f56651ce45e132178839e2283918183f The package's postinstall script callback.js and its declared main entry index.js, byte-identical to callback.js fetch a tarball and a get-pip...

Malicious code in @years18/n8n-nodes-utils-helper-l (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fea406c4c8f2da771cb9d9fd8cba41c74520a876454ab9875fbba17c339966d The package's postinstall script callback.js and its main module index.js, loaded on require are byte-identical droppers. On install and on load they...

Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53 The package's declared postinstall script node callback.js and its main entrypoint index.js contain identical payloads that fire on npm install and...

Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98 The package's postinstall script callback.js and its declared main index.js both fetch two tarballs from...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id...

Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4 The package presents itself as an n8n community node but ships a stub node file nodes/PwnNode.node.js, 213 bytes, description "x" whose only real...

Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install, downloads a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-u (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df The package's postinstall script duplicated as the main module runs unconditionally on npm install. It executes id and hostname, base64-encodes the...

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342 The package's postinstall lifecycle script downloads two tarballs mhddos.tgz, pyroxy.tgz from jasabersama.id over an HTTPS connection with TLS...