@years17/n8n-nodes-utils-helper

{"modified":"2026-08-12T12:53:35Z","published":"2026-08-12T12:38:25Z","schema_version":"1.7.4","id":"MAL-2026-13870","summary":"Malicious code in @years17/n8n-nodes-utils-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2)\nThe package's postinstall script (also executed on require() via index.js) runs a series of host reconnaissance commands (id, hostname, uname -a, docker socket check, sudo -l, docker ps, listings of /home/ubuntu and /root, contents of ~ubuntu/.ssh/authorized_keys, and env vars filtered by docker|n8n|secret|token|key|pass), base64-encodes the output, and transmits it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). Additionally, a bundled n8n node (PwnNode) exposes an execute() method that runs `id; hostname; uname -a; ls -la /home; ls -la /` via child_process.execSync and returns the output as `{ pwned: true, result:... }`, providing an operator-triggered host reconnaissance primitive inside any n8n workflow that uses the node. The package advertises itself as a utility helper but its only functionality is host reconnaissance, secret harvesting, and exfiltration.\n","affected":[{"package":{"ecosystem":"npm","name":"@years17/n8n-nodes-utils-helper"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"669e2b699905aaea1f583b077ba97eac1ffc35d7b47a70425caed7ccdd4a9d98","tlsh":"8d1142f9367c8d308af0c4d75d4b9a5bd09bd10366b2b9c8e08c09952fcb95840134fd"},{"path":"nodes/PwnNode.node.js","sha256":"b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059","tlsh":"fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-1.0.1.tgz","hashes":{"sha1":"e9f46575fd1e195322aeef31fad188a374bd4663","sha512_sri":"sha512-CpEvSQVwi9RhzXbS8O+34yAx39ov3IxnN47uv1HgVOeG9+qq7GHCNg5HqrmRh+HfAzuKXHkL2EVb8U0geF61ng=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017557","import_time":"2026-08-12T12:51:50.078261003Z","modified_time":"2026-08-12T12:38:25Z","sha256":"14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017560","import_time":"2026-08-12T12:51:50.350798176Z","modified_time":"2026-08-12T12:38:47Z","sha256":"33674f60359931b9c96e34c258b3f79ac9bcf0a0f98bbe4c172004e10e138c90","source":"amazon-inspector","versions":["1.0.0"]}]}}