npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13861 blocks this version. @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node (nodes/PwnNode.node.js exports a trivial 'Helper Util...

OpenSSF/OSV malware advisory MAL-2026-13860 blocks this version. Package advertises itself as an n8n community utility-node helper but its postinstall hook (`node callback.js`) fetches tw...

OpenSSF/OSV malware advisory MAL-2026-13859 blocks this version. The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, descrip...

OpenSSF/OSV malware advisory MAL-2026-13858 blocks this version. The package's postinstall script (callback.js) and its declared main (index.js) both fetch two tarballs from https://jasab...

OpenSSF/OSV malware advisory MAL-2026-13857 blocks this version. The package's declared postinstall script (`node callback.js`) and its `main` entrypoint (`index.js`) contain identical pa...

OpenSSF/OSV malware advisory MAL-2026-13856 blocks this version. The package's postinstall script (callback.js) and its main module (index.js, loaded on require) are byte-identical droppe...

OpenSSF/OSV malware advisory MAL-2026-13855 blocks this version. package.json declares `postinstall: node callback.js`, and `main` points at index.js which is byte-identical to callback.j...

OpenSSF/OSV malware advisory MAL-2026-13854 blocks this version. The package ships a postinstall hook (`node callback.js`) and a main entrypoint (`index.js`, byte-identical to callback.js...

OpenSSF/OSV malware advisory MAL-2026-13853 blocks this version. The package's postinstall script (callback.js) and its declared main entry (index.js, byte-identical to callback.js) fetch...

OpenSSF/OSV malware advisory MAL-2026-13852 blocks this version. On npm install, the package's postinstall hook (callback.js / index.js) executes shell commands including `id` and `hostna...

OpenSSF/OSV malware advisory MAL-2026-13851 blocks this version. On npm install, this package auto-runs callback.js via a postinstall hook (and repeats the same behavior in index.js on re...

OpenSSF/OSV malware advisory MAL-2026-13850 blocks this version. Package is presented as an n8n community node but the only node file (nodes/PwnNode.node.js) is a 213-byte stub; the real...

OpenSSF/OSV malware advisory MAL-2026-13849 blocks this version. On `npm install`, the declared postinstall script `node callback.js` performs two hostile actions against the installer. F...

OpenSSF/OSV malware advisory MAL-2026-13848 blocks this version. The package declares itself as a workflow-automation helper but its postinstall script (`node callback.js`) fetches a tarb...

OpenSSF/OSV malware advisory MAL-2026-13847 blocks this version. The package presents itself as an n8n community node but ships a hostile payload in both callback.js (invoked from scripts...

OpenSSF/OSV malware advisory MAL-2026-13868 blocks this version. Package presents itself as an n8n utility helper but ships a 213-byte stub node and a hostile postinstall (`node callback....

OpenSSF/OSV malware advisory MAL-2026-13867 blocks this version. This package presents itself as an n8n workflow helper but ships a near-empty node stub (nodes/PwnNode.node.js, ~213 bytes...

OpenSSF/OSV malware advisory MAL-2026-13866 blocks this version. The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js...

OpenSSF/OSV malware advisory MAL-2026-13865 blocks this version. The package's postinstall script (duplicated as the main module) runs unconditionally on npm install. It executes `id` and...

OpenSSF/OSV malware advisory MAL-2026-13864 blocks this version. The package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on...