@years18/n8n-nodes-utils-helper-p

{"modified":"2026-08-12T12:16:14Z","published":"2026-08-12T12:16:14Z","schema_version":"1.7.4","id":"MAL-2026-13860","summary":"Malicious code in @years18/n8n-nodes-utils-helper-p (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804)\nPackage advertises itself as an n8n community utility-node helper but its postinstall hook (`node callback.js`) fetches two tarballs from jasabersama.id (mhddos.tgz and pyroxy.tgz) with TLS verification disabled, extracts them to /tmp and the Python user site-packages, installs network-attack Python dependencies via `pip install --break-system-packages`, and runs `python3 start.py` on the extracted MHDDoS code — turning the installer's host into a DDoS attack node. The same postinstall captures `id` and `hostname` output plus install progress, base64-encodes it, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate verification disabled). The shipped node file is named `nodes/PwnNode.node.js`, contradicting the package's stated benign purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-p"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"939b22deea396f3518d6d974069b37918201181f7ce418fdac8cf4ad161f7f6c","tlsh":"8f4198b61252a538403363586f2bdd66d66fb10784d8bac8f64d43730f129386d5b76c"},{"path":"package.json","sha256":"31257d3d8d5b1ea051ea992c49b9e3d13bfe9a068dc48754dee6284c5ae17b4d","tlsh":"24f05c028c720f3311cd6b66185941016a246d87949c7c2c73cf010c87986b519bd689"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-p-1.0.0.tgz","hashes":{"sha1":"1ada664a9c6fb378fcab00a82ea226b36c221ec8","sha512_sri":"sha512-HlF3DcSre3HVEJ28E5BaXWghETZL31T3ZflrV13JkxbmvwWlV8QzDBjgmscbNgsJOu4XqHpRh/eqNnglac71VQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-p/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017399","import_time":"2026-08-12T12:24:09.787117121Z","modified_time":"2026-08-12T12:16:14Z","sha256":"0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804","source":"amazon-inspector","versions":["1.0.0"]}]}}