@years19/n8n-nodes-utils-helper-u

{"modified":"2026-08-12T15:08:06Z","published":"2026-08-12T15:08:06Z","schema_version":"1.7.4","id":"MAL-2026-13904","summary":"Malicious code in @years19/n8n-nodes-utils-helper-u (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5)\nThe package's postinstall hook (callback.js) and its declared main entry (index.js, byte-identical to callback.js) both write a Python script to /tmp/attack.py and spawn it via `nohup python3 /tmp/attack.py... &`. The script launches hundreds of UDP/TCP flood threads against the hardcoded target 103.118.252.21 for 600 seconds, turning the installer's host into a DDoS source against a third party. After launching the flood, the code collects host identifiers (`id`, `hostname`, running process count, /proc/loadavg), base64-encodes them, and issues an HTTPS GET to jasabersama.id/portfolio-data.php with query parameters `k=S7k9xQ2mZj&c=<base64>`, with TLS certificate verification disabled (`rejectUnauthorized: false`). Because index.js is the module's main entry, the same dropper also fires whenever the package is `require`d — for example when loaded as an n8n community node — in addition to firing on `npm install` via the postinstall lifecycle hook.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-u"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"2d4a88d7ac61db1d7d9afad967897f9a65e2e2556019e3711f7749d0471ba641","tlsh":"174183e33ab89434d5b32090a8a6ee42a627b10b5586fdd8f04dd6b20f6b03827914f4"},{"path":"index.js","sha256":"2d4a88d7ac61db1d7d9afad967897f9a65e2e2556019e3711f7749d0471ba641","tlsh":"174183e33ab89434d5b32090a8a6ee42a627b10b5586fdd8f04dd6b20f6b03827914f4"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-u-1.0.0.tgz","hashes":{"sha1":"357636d068cdfeb28911309de68bc4fb9400faee","sha512_sri":"sha512-dmcL6Pn3Q+sH7FhG4gEZuql362QqYaAf78DKT3orGEx4zYEYjYdEl44GP65y1vPYL0XnUCrik59qeZAh7juO0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-u/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017583","import_time":"2026-08-12T15:26:11.778643971Z","modified_time":"2026-08-12T15:08:06Z","sha256":"c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5","source":"amazon-inspector","versions":["1.0.0"]}]}}