@years18/n8n-nodes-utils-helper-d

{"modified":"2026-08-12T12:17:35Z","published":"2026-08-12T12:17:35Z","schema_version":"1.7.4","id":"MAL-2026-13850","summary":"Malicious code in @years18/n8n-nodes-utils-helper-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e)\nPackage is presented as an n8n community node but the only node file (nodes/PwnNode.node.js) is a 213-byte stub; the real behavior is in callback.js, which is invoked by the postinstall lifecycle hook (\"postinstall\": \"node callback.js\"). On install, callback.js performs three attacker-benefit actions against the installer's host: (1) it fetches https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over TLS with certificate validation disabled (rejectUnauthorized: false), writes it to /tmp/mhddos.tgz, extracts it, pip-installs its declared requirements, and runs python3 start.py — unattended remote code execution of a mutable third-party archive labelled after the mhddos DDoS tool family; (2) it runs `id` and `hostname` and probes an internal TCP endpoint, base64-encodes the combined output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, leaking installer identity and network state to the same author-controlled host; (3) it executes `bash -c 'echo > /dev/tcp/10.131.106.93/8888'` against a hardcoded RFC1918 address (with a source comment referring to Sliver, an offensive C2 framework) and reports reachability back — internal-network reconnaissance consistent with lateral-movement staging. index.js contains the same payload as callback.js, ensuring the code also runs on require of the module.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"ec95ab71a5b43888d96ada87905d1fb6551d899210181e33fdb78d9110359ff9","tlsh":"094151f9126351388563729c6b2bdd1bf46bf00b5081bec8fa8f43b38f125189d566a8"},{"path":"package.json","sha256":"9833640ac272d8c24149b9be031b3a3f5cc06ba7852a2eda829150edeaeaffe5","tlsh":"22f055028cb20f3321cd6b66189a8101aa246e8b949c7c2873cf010c87986b52abe689"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-d-1.0.0.tgz","hashes":{"sha1":"c6b7f98646ca95011163c7ba2a5b1f4b5f09e4a7","sha512_sri":"sha512-tHsRFqN4INkO9hAp5eartyxNCp2ZTqaknz3PF5IqCVF/sMzD7Z8YL7rW4tiJ6qe8d1LX5PX8XlxO78hv1LgI9A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-d/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017409","import_time":"2026-08-12T12:24:10.853798127Z","modified_time":"2026-08-12T12:17:35Z","sha256":"0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e","source":"amazon-inspector","versions":["1.0.0"]}]}}