@years18/n8n-nodes-utils-helper-e

{"modified":"2026-08-12T12:17:28Z","published":"2026-08-12T12:17:28Z","schema_version":"1.7.4","id":"MAL-2026-13851","summary":"Malicious code in @years18/n8n-nodes-utils-helper-e (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330)\nOn npm install, this package auto-runs callback.js via a postinstall hook (and repeats the same behavior in index.js on require). The script shells out to install pip from /tmp/get-pip.py, then installs requirements for and launches an mhddos DDoS toolkit staged at /tmp/mhddos (python3 start.py), and probes an internal-network address at 10.131.106.93:8888. It then collects installer identity via `id` and `hostname` plus command output, base64-encodes the results, and sends them as a query string to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The URL carries a `c=` parameter containing a shell command written to /tmp/n8n_rce_result.txt, structured as a keyed (k=S7k9xQ2mZj) command channel consistent with a staged RCE relay on the attacker's server. The package name resembles a helper for n8n but its only shipped behavior is dropper, DDoS-tool bootstrap, and exfiltration.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-e"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"4cebce1f6b6c2155570f01ea57fa54308ce2cc2f8b0f7367ca33c14c0bf8d8ec","tlsh":"a93165f42350e1348a13a0d47a27e956f4abf2071098bbc8f58f42738b23954ab5316d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-e-1.0.0.tgz","hashes":{"sha1":"bb48d504bdb7252d47d97955f76f74f76aafcd3d","sha512_sri":"sha512-qkMx6GrWzzy+3C2DZqlVI+jdkn46Rbu8tfEbOXQndRJcNC3konKCQNk4bgEy8N3PqN2lUxn4rx5m0WbMusx3Hw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-e/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017408","import_time":"2026-08-12T12:24:10.747863677Z","modified_time":"2026-08-12T12:17:28Z","sha256":"d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330","source":"amazon-inspector","versions":["1.0.0"]}]}}