@years18/n8n-nodes-utils-helper-k

{"modified":"2026-08-12T12:16:35Z","published":"2026-08-12T12:16:35Z","schema_version":"1.7.4","id":"MAL-2026-13855","summary":"Malicious code in @years18/n8n-nodes-utils-helper-k (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69)\npackage.json declares `postinstall: node callback.js`, and `main` points at index.js which is byte-identical to callback.js. Both files, when executed, download a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz plus get-pip.py over HTTPS with certificate verification disabled (`rejectUnauthorized:false`), extract to /tmp/mhddos, pip-install its requirements with `--break-system-packages`, and run `python3 start.py`. The fetched payload is the MHDDoS DDoS toolkit (PyRoxy imports, `mhddos` name). The same scripts also collect installer host identity — `id`, hostname, WSL/VM/container indicators, $HOME, and command output — base64-encode it, and send it via HTTPS GET query string to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<base64>. Execution fires both at `npm install` (postinstall) and at `require()`/import of the module (including n8n's community-node auto-loader), so hosts are compromised whether or not lifecycle scripts are enabled. Payload staging paths are disguised under `/assets/cache/.theme-backup/dl/` and the exfil endpoint is named `/portfolio-data.php` as a cover story.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-k"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"8652c6eb26f419729cae5eaa04db4fea4d8c06a7d784fe3372247472b5d9c529","tlsh":"e04166b91261a138457371942f2bdb1a956ff10750c4aec8f74e43b38f1252c992b66c"},{"path":"index.js","sha256":"8652c6eb26f419729cae5eaa04db4fea4d8c06a7d784fe3372247472b5d9c529","tlsh":"e04166b91261a138457371942f2bdb1a956ff10750c4aec8f74e43b38f1252c992b66c"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-k-1.0.0.tgz","hashes":{"sha1":"f9d74d71aaa64ca33b4b1f648565417e3223006b","sha512_sri":"sha512-KhGACAb30BPLSaI58U+FLT8J6Tpapkt1DPC+p72NncMu7L0jgC7yhWv0giFeNRM1s9lvhy9E//I6hPbbsxziRg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-k/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017402","import_time":"2026-08-12T12:24:10.121876337Z","modified_time":"2026-08-12T12:16:35Z","sha256":"98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69","source":"amazon-inspector","versions":["1.0.0"]}]}}