@years19/n8n-nodes-utils-helper-w

{"modified":"2026-08-12T15:07:14Z","published":"2026-08-12T15:07:14Z","schema_version":"1.7.4","id":"MAL-2026-13906","summary":"Malicious code in @years19/n8n-nodes-utils-helper-w (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5)\nThe package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code that (1) writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP 103.118.252.21 for 900 seconds and launches it via `nohup python3 /tmp/attack2.py... &`, and (2) collects the installer's shell id, hostname, /proc/loadavg and process listing, base64-encodes the blob, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (`rejectUnauthorized: false`). Both triggers fire automatically: the postinstall runs on `npm install`, and the identical main module runs again when n8n loads the community node via `require()`. The package presents itself as an n8n utility helper but ships no functional node code matching that purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-w"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"2b32e5688aaeb3911c8d3da7927f1569ff2987e60b24c626f0e0295d2f3769e9","tlsh":"1b4188d23eb49574d5b3605099a6de42e727f00b56c2edd8f04dd7b20f5a03427914f4"},{"path":"index.js","sha256":"2b32e5688aaeb3911c8d3da7927f1569ff2987e60b24c626f0e0295d2f3769e9","tlsh":"1b4188d23eb49574d5b3605099a6de42e727f00b56c2edd8f04dd7b20f5a03427914f4"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-w-1.0.0.tgz","hashes":{"sha1":"be1c4caf0d90248e0c8d5d77eb64d93d90146a95","sha512_sri":"sha512-ctsFD5ZK0ry6Nt5ztFPAhLYFiQbUYkCiNAlPAhgj0H5zMiHQJD7jaI/znGLdLwHpC3BRgcGxotQqk60TsSFGyw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-w/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017577","import_time":"2026-08-12T15:26:11.353848364Z","modified_time":"2026-08-12T15:07:14Z","sha256":"a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5","source":"amazon-inspector","versions":["1.0.0"]}]}}