@years19/n8n-nodes-utils-helper-f

{"modified":"2026-08-12T15:11:30Z","published":"2026-08-12T15:11:30Z","schema_version":"1.7.4","id":"MAL-2026-13889","summary":"Malicious code in @years19/n8n-nodes-utils-helper-f (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120)\nThe package's postinstall (scripts.postinstall: node callback.js) collects host identity and environment fingerprint (output of `id`, hostname, Python user-site path with its contents filtered for offensive-tooling keywords such as pyroxy/impacket/multidict/socks/maxmind, presence of /tmp/mhddos and /tmp/implant, uptime), base64-encodes the result, and sends it as a query string to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The request path also includes a hardcoded key `k=S7k9xQ2mZj` and a `c=` parameter carrying `echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt`, matching a beacon/check-in shape for an attacker-controlled command channel. The package poses as an n8n community node (nodes/PwnNode.node.js exports only a stub description) while `main` (index.js) is identical to the postinstall exfil script, so both `npm install` and any `require` of the package trigger the beacon. The name mimics legitimate `n8n-nodes-*` community naming.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-f"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"527f25402cc3291fc3cc44b373722dd2ae95d847040fddfee8188abfe6ece103","tlsh":"582153f55390e230547321a4bb6fec61dc2bf7060089f9c0f10d85730b2285826465bd"},{"path":"nodes/PwnNode.node.js","sha256":"459f81ea09ad6732ede55a7a0eb7b36edb28d8f4c33a2f72c9695e76cb0dde7c","tlsh":"3bd023074821758300779451bff1730f15308341d722dc3d58c4c70b132e54c6990d6d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-f-1.0.0.tgz","hashes":{"sha1":"94bd6f2fb58ede74a9f344ff1dd0847cbfdcffa5","sha512_sri":"sha512-j4wBUl17DJu+me6gdKwQDxa1Qi+OzuPMWYHnMUM0Bkr9XUQpYb11HiD/EZ6ZaPoBfPFTV/OJfuCknEyPt4F9LQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-f/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017606","import_time":"2026-08-12T15:26:14.175721056Z","modified_time":"2026-08-12T15:11:30Z","sha256":"0200e9a9dfdd3de819e8111363492aa235bd40790b89adc91a5d7e0a410ae120","source":"amazon-inspector","versions":["1.0.0"]}]}}