@years18/n8n-nodes-utils-helper-t

{"modified":"2026-08-12T12:15:12Z","published":"2026-08-12T12:15:12Z","schema_version":"1.7.4","id":"MAL-2026-13864","summary":"Malicious code in @years18/n8n-nodes-utils-helper-t (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea)\nThe package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on `npm install` and on `require()`. The payload runs `id` and `hostname`, base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php with `k=` and `c=` query parameters; TLS certificate verification is disabled (`rejectUnauthorized:false`). The `c=` parameter carries a base64-decode-and-append shell command written to /tmp/n8n_rce_result.txt, giving the operator a server-driven command channel. The same script pip-installs `impacket` with `--break-system-packages`, probes for `PyRoxy`, and executes `python3 start.py` under /tmp/mhddos — staging and running an mhddos DDoS toolkit on the installer host. The package name mimics a legitimate n8n community node to lure installation.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-t"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"4e3b8c5eb59ae45053e07d90e2e09f4a5d16670876330c8dd3f152ccc3527bd4","tlsh":"5521f0f51201e1348572f0a4ba6bde56f86ff70310dab5c8f10e86b34b125596b135a8"},{"path":"index.js","sha256":"4e3b8c5eb59ae45053e07d90e2e09f4a5d16670876330c8dd3f152ccc3527bd4","tlsh":"5521f0f51201e1348572f0a4ba6bde56f86ff70310dab5c8f10e86b34b125596b135a8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-t-1.0.0.tgz","hashes":{"sha1":"c40706ea0fe81ec2c08119d6eaf12d673040ba0b","sha512_sri":"sha512-YR8uwjinvyhI99fgpyfVOzZs9u+ypo3niJqhlYpBki1JtwPjSxWPWlCrWbj/cGVmaeKYQn2t8zXqMigqu+B4HQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-t/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017392","import_time":"2026-08-12T12:24:09.031519492Z","modified_time":"2026-08-12T12:15:12Z","sha256":"d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea","source":"amazon-inspector","versions":["1.0.0"]}]}}