@years17/n8n-nodes-utils-helper-h

{"modified":"2026-08-12T12:37:58Z","published":"2026-08-12T12:37:58Z","schema_version":"1.7.4","id":"MAL-2026-13877","summary":"Malicious code in @years17/n8n-nodes-utils-helper-h (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b)\nThe package's postinstall script executes callback.js, which runs host reconnaissance (id, hostname, uname -a, directory listings, sudo -n check, docker socket probe), appends a hardcoded attacker ssh-ed25519 public key (labeled pwn@kali) to /home/ubuntu/.ssh/authorized_keys establishing persistent SSH access, and exfiltrates base64-encoded recon output via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). Additionally, the bundled n8n node (PwnNode.node.js) exposes a HelperUtils.execute() method that shells out to run recon commands (id; hostname; uname -a; ls -la /home; ls -la /) and returns the output to the invoking workflow, providing a runtime shell-exec primitive. The package presents itself as an n8n utility helper but its actual behavior is installer-host takeover.\n","affected":[{"package":{"ecosystem":"npm","name":"@years17/n8n-nodes-utils-helper-h"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"2adf8b78ec9205232c34c87fb59a5850f107f06a448df2b105b4a74a8ef9ae3f","tlsh":"2f2146f532785d708bf4c5931d5f95b6f49b910316b278c4e0cc48a52bc799846329bd"},{"path":"nodes/PwnNode.node.js","sha256":"b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059","tlsh":"fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-h-1.0.0.tgz","hashes":{"sha1":"2658bd3a4964ada7e1ff551e5403a45d3f1438bc","sha512_sri":"sha512-QAAjQAdV6Ggji31P7Qk5jM9eeF3kz0CFaqD/LOjaTA5fKDY3iXTH+5JVBIo3hMJLVpFnPfk/ZpJW4d7ENonalg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-h/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017554","import_time":"2026-08-12T12:51:49.891163867Z","modified_time":"2026-08-12T12:37:58Z","sha256":"aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b","source":"amazon-inspector","versions":["1.0.0"]}]}}