@years18/n8n-nodes-utils-helper-m

{"modified":"2026-08-12T12:16:28Z","published":"2026-08-12T12:16:28Z","schema_version":"1.7.4","id":"MAL-2026-13857","summary":"Malicious code in @years18/n8n-nodes-utils-helper-m (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53)\nThe package's declared postinstall script (`node callback.js`) and its `main` entrypoint (`index.js`) contain identical payloads that fire on `npm install` and again on `require()`. The payload downloads a tarball from `https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy.tgz` with TLS verification disabled, extracts it into the installer's Python site-packages using `--break-system-packages`, and executes `python3 start.py` from `/tmp/mhddos` (the mhddos / PyRoxy DDoS tool). The same code collects the installer's user id, hostname, and command-execution output, base64-encodes them, and sends them as a query parameter to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=...`, again with `rejectUnauthorized: false`. The package name mimics an n8n community-nodes helper but its shipped code performs no such functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-m"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"821bbd9ed8e5d7a6fe0aef9478701c941545b83583ab1f70cf643ac3b72cbb6a","tlsh":"c64175b51262e634853362646f1bde76d66fb50358c8bec8f24d43730f128387e6a66c"},{"path":"index.js","sha256":"821bbd9ed8e5d7a6fe0aef9478701c941545b83583ab1f70cf643ac3b72cbb6a","tlsh":"c64175b51262e634853362646f1bde76d66fb50358c8bec8f24d43730f128387e6a66c"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-m-1.0.0.tgz","hashes":{"sha1":"9ec6f8c229865c4f4f76b05c7e52876add2a9410","sha512_sri":"sha512-Phd7JvVdjnBm+DYfUGyf78egYSysQosZwAzocKDc6wH4ssACTLPH7/QfMFSb8KLCszgFBnaYYiydv1PW9K7UpA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-m/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017401","import_time":"2026-08-12T12:24:10.027840455Z","modified_time":"2026-08-12T12:16:28Z","sha256":"5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53","source":"amazon-inspector","versions":["1.0.0"]}]}}