@years19/n8n-nodes-utils-helper-o

{"modified":"2026-08-12T15:08:31Z","published":"2026-08-12T15:08:31Z","schema_version":"1.7.4","id":"MAL-2026-13898","summary":"Malicious code in @years19/n8n-nodes-utils-helper-o (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51)\nOn npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes `id` and `hostname`, base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-o"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd","tlsh":"1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78"},{"path":"index.js","sha256":"47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd","tlsh":"1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-o-1.0.0.tgz","hashes":{"sha1":"18bd652bf5cd47bccee4ae06f4ca9b754dab11d0","sha512_sri":"sha512-UViCXAx8wu75SU4VCxZlLY42oMmlyNYQiK6NaxIzwYnGsGnXyqYQNLITDRw4xDhZA83im7hc+xN4JRodOPKrdw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-o/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017586","import_time":"2026-08-12T15:26:12.113255092Z","modified_time":"2026-08-12T15:08:31Z","sha256":"79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51","source":"amazon-inspector","versions":["1.0.0"]}]}}