@years19/n8n-nodes-utils-helper-d

{"modified":"2026-08-12T15:10:45Z","published":"2026-08-12T15:10:45Z","schema_version":"1.7.4","id":"MAL-2026-13887","summary":"Malicious code in @years19/n8n-nodes-utils-helper-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7)\nThe package presents itself as an n8n community node (`n8n-nodes-utils-helper-d`) but its actual on-install behavior is unrelated to workflow automation. The postinstall script fetches a tarball from `https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz` over an HTTPS connection with TLS certificate validation disabled (`rejectUnauthorized:false`) and extracts it into the user's Python site-packages, shadowing the real `multidict` module so subsequent `import multidict` in the environment executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and `/tmp/mhddos/start.py`, consistent with a DDoS / offensive-tooling dropper. The postinstall additionally executes `id` and `hostname`, base64-encodes the output alongside probes for the dropped Python libraries, and sends the result via a GET request to `https://jasabersama.id/portfolio-data.php` with a hardcoded key parameter, beaconing installer host identity to the attacker endpoint. The shipped node file is a stub named `PwnNode.node.js`, and no legitimate n8n node functionality is present.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"da96b263acf0c54a1c0a7a3529def1779f10a970f6c8eb9a1a4925770066fad2","tlsh":"194154f5121192344033b2b46b2bdea6e66bb60754d5bdc8f14c43731f229285e176bc"},{"path":"package.json","sha256":"80a9429c4df8ec0d8e05b2d20109441985d3d3971aac9cdb545ea5a5b209927e","tlsh":"21f0ab038c720f3321cdab66189a8101ab246e8b949c7c2c73cf010c87dc7f52abe68d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-d-1.0.0.tgz","hashes":{"sha1":"3f008ce704cd7c4396ee4250bd237da3a82eb4e5","sha512_sri":"sha512-eXsPN7FjzOfWMHJh2SkVOo/Jh4aFyk9Ia4q2jr+VDuokIxv3bJgt7TM8eo9G+spuASq0hbkRiUlblSxUHxivFQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-d/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017602","import_time":"2026-08-12T15:26:13.683532197Z","modified_time":"2026-08-12T15:10:45Z","sha256":"72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7","source":"amazon-inspector","versions":["1.0.0"]}]}}