@years18/n8n-nodes-utils-helper-y

{"modified":"2026-08-12T15:11:13Z","published":"2026-08-12T15:11:13Z","schema_version":"1.7.4","id":"MAL-2026-13883","summary":"Malicious code in @years18/n8n-nodes-utils-helper-y (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1342694c7cf44fdd451ec464ebcee8acca8523770f147805b8b3c4a7ae225fa)\nThe package's postinstall hook (`node callback.js`) fetches three tarballs (mhddos, pyroxy-full, impacket) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts pyroxy-full and impacket into the invoking user's Python site-packages, stages mhddos under /tmp, and executes `python3 start.py` from the extracted mhddos toolkit. Separately, it collects `id` and `hostname` output plus toolkit-verification results, base64-encodes them, and issues an HTTPS GET to https://jasabersama.id/portfolio-data.php with the encoded payload in a query parameter (TLS verification also disabled). Installing this package auto-executes attacker-controlled code on the installer's host at `npm install` time, plants offensive Python toolkits (impacket, PyRoxy) into the user's site-packages so they remain importable from later Python processes, and reports the compromised host back to the attacker's endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"@years18/n8n-nodes-utils-helper-y"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"4ec5b14887ecc30e083dbfcb89b970b7bca2e0c4d83f6c8b37ef264940b366e7","tlsh":"fd41b6b91251513d403372686f2bdd3aea6f720344d4b9c8fa4d47b35b0152c4a9ff68"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-y-1.0.0.tgz","hashes":{"sha1":"a8cd85cef3553fe98e092507f9dee3ad126e0de0","sha512_sri":"sha512-LPayyR8OqNj5Rv8g+p7uenvvfZXUdH6OkcOQVSsnnOqT1uLPHNRW2z8c02/aENquomrusdtljaFKiowuQ7AMNQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-y/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017605","import_time":"2026-08-12T15:26:14.090668111Z","modified_time":"2026-08-12T15:11:13Z","sha256":"d1342694c7cf44fdd451ec464ebcee8acca8523770f147805b8b3c4a7ae225fa","source":"amazon-inspector","versions":["1.0.0"]}]}}