npm advisory reports, with evidence.

OpenSSF Malicious Packages via OSV confirms @biz44/runtime-utils@1.1.100 as malicious (MAL-2026-16172): Malicious code in @biz44/runtime-utils (npm)

OpenSSF Malicious Packages via OSV confirms @biz44/process-runtime-utils@1.1.95 as malicious (MAL-2026-16171): Malicious code in @biz44/process-runtime-utils (npm)

OpenSSF Malicious Packages via OSV confirms @biz44/process-runtime-utils@1.1.79 as malicious (MAL-2026-16171): Malicious code in @biz44/process-runtime-utils (npm)

OpenSSF Malicious Packages via OSV confirms @biz44/process-runtime-utils@1.1.10 as malicious (MAL-2026-16171): Malicious code in @biz44/process-runtime-utils (npm)

This package contains an import-triggered detached remote-code loader, not the runtime utilities claimed by its manifest. The remote payload is executed with Node module access, creating...

This is a concrete install-time remote-code-execution backdoor, not functionality required by the stated n8n health-monitor node. The listener is exposed on all interfaces and has no auth...

The package executes an opaque remotely supplied payload automatically on import through a detached background process. Although it has no install hook, this is concrete remote code execu...

This is a concrete opaque browser redirect chain with a concealed remote destination and no legitimate package functionality. Although it has no npm lifecycle hook, opening its declared e...

The package is an opaque, browser-executed redirector that deliberately hides its final destination and carries visitor parameters across the redirect. The absence of install hooks does n...

The concealed destination, automatic redirect flow, and verification-page disguise establish malicious browser redirection. The absence of npm lifecycle hooks limits installation-time imp...

The package has no npm lifecycle hook, but its sole runtime entrypoint is an obfuscated remote redirector. The hidden destination and parameter forwarding create a concrete malicious brow...

This is concrete user-triggered bulk file exfiltration to a source-controlled Telegram destination, inconsistent with the package identity. The absence of an install hook does not remove...

This is a concealed browser redirector packaged as an npm module, with a fake Cloudflare challenge used to gate navigation. The obfuscation and encrypted destination conceal a concrete ph...

OpenSSF Malicious Packages via OSV confirms n8n-nodes-sysdiag2@2.0.0 as malicious (MAL-2026-16162): Malicious code in n8n-nodes-sysdiag2 (npm)

OpenSSF Malicious Packages via OSV confirms afhmxiewpsf@1.0.5 as malicious (MAL-2026-16158): Malicious code in afhmxiewpsf (npm)

OpenSSF Malicious Packages via OSV confirms afhmxiewpsf@1.0.4 as malicious (MAL-2026-16158): Malicious code in afhmxiewpsf (npm)

OpenSSF Malicious Packages via OSV confirms afhmxiewpsf@1.0.3 as malicious (MAL-2026-16158): Malicious code in afhmxiewpsf (npm)

OpenSSF Malicious Packages via OSV confirms afhmxiewpsf@1.0.2 as malicious (MAL-2026-16158): Malicious code in afhmxiewpsf (npm)

OpenSSF Malicious Packages via OSV confirms get-power@1.0.3 as malicious (MAL-2026-16156): Malicious code in get-power (npm)

OpenSSF Malicious Packages via OSV confirms pino-ulid@2.12.3 as malicious (MAL-2026-16154): Malicious code in pino-ulid (npm)