npm advisory reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-13911 blocks this version. On npm install, callback.js/index.js (invoked from the package's postinstall/main) executes `id` and `hostname`, reads `/e...

OpenSSF/OSV malware advisory MAL-2026-13910 blocks this version. On npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute `id`, `ho...

OpenSSF/OSV malware advisory MAL-2026-13909 blocks this version. The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on bo...

OpenSSF/OSV malware advisory MAL-2026-13908 blocks this version. The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.no...

OpenSSF/OSV malware advisory MAL-2026-13907 blocks this version. The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to c...

OpenSSF/OSV malware advisory MAL-2026-13906 blocks this version. The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code...

OpenSSF/OSV malware advisory MAL-2026-13902 blocks this version. The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.2...

OpenSSF/OSV malware advisory MAL-2026-13901 blocks this version. The package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `...

OpenSSF/OSV malware advisory MAL-2026-13899 blocks this version. On npm install (postinstall) and on require of the main entry index.js, the package fetches multiple tarballs (mhddos, pyr...

OpenSSF/OSV malware advisory MAL-2026-13898 blocks this version. On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the de...

OpenSSF/OSV malware advisory MAL-2026-13897 blocks this version. Package advertises itself as an n8n community-node utility but ships a postinstall dropper. package.json declares postinst...

OpenSSF/OSV malware advisory MAL-2026-13896 blocks this version. On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict...

OpenSSF/OSV malware advisory MAL-2026-13895 blocks this version. The package's postinstall script and its main entrypoint (index.js, byte-identical to callback.js) fetch four tarballs (mh...

OpenSSF/OSV malware advisory MAL-2026-13894 blocks this version. The package's postinstall script callback.js — duplicated byte-for-byte as index.js declared as the package main — fetches...

OpenSSF/OSV malware advisory MAL-2026-13893 blocks this version. package.json postinstall runs callback.js, and index.js (declared main) is byte-identical, so both `npm install` and any `...

OpenSSF/OSV malware advisory MAL-2026-13892 blocks this version. The package's postinstall script executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multi...

OpenSSF/OSV malware advisory MAL-2026-13891 blocks this version. On install, callback.js (also present as index.js and wired as the postinstall hook) downloads four Python tarballs (mhddo...

OpenSSF/OSV malware advisory MAL-2026-13889 blocks this version. The package's postinstall (scripts.postinstall: node callback.js) collects host identity and environment fingerprint (outp...

OpenSSF/OSV malware advisory MAL-2026-13888 blocks this version. Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte...

OpenSSF/OSV malware advisory MAL-2026-13887 blocks this version. The package presents itself as an n8n community node (`n8n-nodes-utils-helper-d`) but its actual on-install behavior is un...

OpenSSF/OSV malware advisory MAL-2026-13886 blocks this version. The npm package's postinstall script (callback.js) resolves the user's Python site-packages directory and downloads a tarb...