@years19/n8n-nodes-utils-helper-a

{"modified":"2026-08-12T15:11:04Z","published":"2026-08-12T15:11:04Z","schema_version":"1.7.4","id":"MAL-2026-13884","summary":"Malicious code in @years19/n8n-nodes-utils-helper-a (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e)\nThe package advertises itself as an n8n utility helper and registers a trivial stub node (nodes/PwnNode.node.js), but its postinstall lifecycle script performs the actual behavior. On install it fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), extracts it into the user's Python site-packages directory, and invokes attack tooling from the dropped archive (PyRoxy, impacket, mhddos /tmp/mhddos/start.py). The same postinstall executes `id` and `hostname` on the installer's machine, base64-encodes the output together with results from the dropped payload, and sends them to https://jasabersama.id/portfolio-data.php via an https.get whose path smuggles a base64-piped shell command. Installing the package results in attacker-controlled code being written to the Python import path and executed on the installer's host, and installer identity/execution results being transmitted to the author-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-a"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"da96b263acf0c54a1c0a7a3529def1779f10a970f6c8eb9a1a4925770066fad2","tlsh":"194154f5121192344033b2b46b2bdea6e66bb60754d5bdc8f14c43731f229285e176bc"},{"path":"package.json","sha256":"c76c2bb81f78bdea2048fc9f5a80250940025f708f8b53c220364bdd8f549f67","tlsh":"72f0a3038c720f3311cd6b67185941416b246e87949c7c2c73cf010c87dc6f519bd58d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-a-1.0.0.tgz","hashes":{"sha1":"3316bd4f6d04a3069b4fa459c85d03612a5daf56","sha512_sri":"sha512-ZdanWNRWUOydDdyiZ0szk1v5LdZco18ftM/yII9oqVCoCnlAYZ6v6kei/2DVTNwcJqPBWkuD8gSA3IzOKfRC9g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-a/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017604","import_time":"2026-08-12T15:26:14.028470322Z","modified_time":"2026-08-12T15:11:04Z","sha256":"3bd60aaab1ca86f97939ddbea892feba63b7d911dd038a8d6f348ece5af3a76e","source":"amazon-inspector","versions":["1.0.0"]}]}}