@years17/n8n-nodes-utils-helper-d

{"modified":"2026-08-12T12:38:15Z","published":"2026-08-12T12:38:15Z","schema_version":"1.7.4","id":"MAL-2026-13873","summary":"Malicious code in @years17/n8n-nodes-utils-helper-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603)\nOn `npm install`, the package's postinstall hook runs `node callback.js` (with identical logic duplicated in `index.js` so it also fires on require). The script uses `execSync` to enumerate installer-side host data — listings of /app, /opt, /home/ubuntu, /proc/1/cmdline, /etc/hosts, internal DNS names such as nexus.local/proxy.nexus.local, and the contents of /home/ubuntu/.ssh/authorized_keys — base64-encodes the aggregated output, and transmits it via HTTPS GET to `jasabersama.id/portfolio-data.php` with `rejectUnauthorized: false` (TLS verification disabled). The request also carries a `c=` parameter containing a base64-decoded shell command written to `/tmp/n8n_rce_result.txt`, consistent with an attacker-side command-delivery handler. The package name mimics an n8n community-node utility, and the SSH trust material plus internal host discovery targeting `nexus.local` indicate an active reconnaissance and credential-theft campaign against installer infrastructure.\n","affected":[{"package":{"ecosystem":"npm","name":"@years17/n8n-nodes-utils-helper-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"19de5151c66379be521e968f108bb8f5813580578abbbcc642801ce08c504f8b","tlsh":"472163f6337d9830d2f4e097ac4fa485e4abd10718ba79d8e0cc8daa1bc555c56328b5"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-d-1.0.0.tgz","hashes":{"sha1":"ca03938a381d437d9250c036cc701b7ad17efc64","sha512_sri":"sha512-3ZPhKcZ2TFmzqvHfKNtANNNIFyuxUa8zuCCHeJYpAP+3m41NQzH0eNE8IU6XCXyqCbK8UntowOzXjctTw16MCQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-d/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017556","import_time":"2026-08-12T12:51:49.99368714Z","modified_time":"2026-08-12T12:38:15Z","sha256":"cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603","source":"amazon-inspector","versions":["1.0.0"]}]}}