@years17/n8n-nodes-utils-helper-f

{"modified":"2026-08-12T12:37:29Z","published":"2026-08-12T12:37:29Z","schema_version":"1.7.4","id":"MAL-2026-13875","summary":"Malicious code in @years17/n8n-nodes-utils-helper-f (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8)\nThe package's postinstall script (duplicated in index.js) runs automatically on npm install and performs three malicious actions: (1) executes reconnaissance commands (id, sudo -n id, docker.sock check, /etc/hosts, hostname) and base64-exfiltrates the output over HTTPS to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false); (2) appends a hardcoded attacker ssh-ed25519 public key (comment 'pwn@kali') to /home/ubuntu/.ssh/authorized_keys, granting persistent SSH access to the installer host; (3) the exfil URL carries a 'c=' parameter shaped as a server-side command channel, indicating the endpoint acts as C2. Additionally, the shipped n8n node registered as 'nodes/PwnNode.node.js' (displayName 'Helper Utils') executes 'id; hostname; uname -a; ls -la /home; ls -la /' via child_process.execSync on workflow run and returns { pwned: true, result:... }. The package self-labels its class 'PwnNode' with a 'pwned: true' output flag.\n","affected":[{"package":{"ecosystem":"npm","name":"@years17/n8n-nodes-utils-helper-f"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"2adf8b78ec9205232c34c87fb59a5850f107f06a448df2b105b4a74a8ef9ae3f","tlsh":"2f2146f532785d708bf4c5931d5f95b6f49b910316b278c4e0cc48a52bc799846329bd"},{"path":"nodes/PwnNode.node.js","sha256":"b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059","tlsh":"fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-f-1.0.0.tgz","hashes":{"sha1":"c6a5238f8f9171d9b69d1e7198f73354ff02d01d","sha512_sri":"sha512-nZJyxNYxfSQ+smR0AUsiufkjPRr7v6mmL8H1jycAcj1CTAJUSRreUcFHRGFov5cS9C/1LjMI3p6qd3djBJBBAA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-f/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017550","import_time":"2026-08-12T12:51:49.63102081Z","modified_time":"2026-08-12T12:37:29Z","sha256":"9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8","source":"amazon-inspector","versions":["1.0.0"]}]}}