@years19/n8n-nodes-utils-helper-q

{"modified":"2026-08-12T15:07:04Z","published":"2026-08-12T15:07:04Z","schema_version":"1.7.4","id":"MAL-2026-13900","summary":"Malicious code in @years19/n8n-nodes-utils-helper-q (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a)\nPackage @years19/n8n-nodes-utils-helper-q@1.0.0 ships two byte-identical top-level scripts (callback.js and index.js). package.json declares \"main\":\"index.js\" and \"postinstall\":\"node callback.js\", so the same payload fires both on npm install and on any require()/import of the package. On execution the scripts download multiple tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract them under /tmp, and spawn python3 start.py in the background to launch UDP/TCP/GET flood traffic against 103.118.252.21 — turning the installer's machine into a DDoS attack node. Separately, the scripts run `id` and `hostname`, base64-encode the output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating installer host identity to a hardcoded attacker-controlled endpoint. Multiple auto-execution paths, TLS validation disabled, and an unrelated non-publisher host delivering opaque archives that are then executed match a canonical install-time RCE / dropper with concurrent host abuse and exfiltration.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-q"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"9f7f0b9b6e69f8174b545382d7c38dba3fed850da59ab0de0790e8d6f39510b7","tlsh":"ca5163f41a20743c023351685a17fc69d62fa30b1890f9d9fb8e56b2ab05a18c71bf75"},{"path":"index.js","sha256":"9f7f0b9b6e69f8174b545382d7c38dba3fed850da59ab0de0790e8d6f39510b7","tlsh":"ca5163f41a20743c023351685a17fc69d62fa30b1890f9d9fb8e56b2ab05a18c71bf75"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-q-1.0.0.tgz","hashes":{"sha1":"2e4731f21b42a1e7acd732410eb90944c0d15a1e","sha512_sri":"sha512-FZfGi6zvVuinLy7ab8ng8l1dbYcvUBKlqR9yx5qs7HzQ6BGHKYkHf3BIYS/Tfk0h82+iVOLAhF8/VasqVvQpGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-q/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017576","import_time":"2026-08-12T15:26:11.277310628Z","modified_time":"2026-08-12T15:07:04Z","sha256":"ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a","source":"amazon-inspector","versions":["1.0.0"]}]}}