@years19/n8n-nodes-utils-helper-x

{"modified":"2026-08-12T15:07:41Z","published":"2026-08-12T15:07:41Z","schema_version":"1.7.4","id":"MAL-2026-13907","summary":"Malicious code in @years19/n8n-nodes-utils-helper-x (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4)\nThe package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via `nohup python3 /tmp/attack2.py &`, weaponizing the installer's host and IP as a DDoS bot. In parallel, it collects the output of `id`, `hostname`, a process check and /proc/loadavg, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The package is presented as an n8n utility helper but ships no such functionality; its only observable behavior is the DDoS launcher and host-identity beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"@years19/n8n-nodes-utils-helper-x"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"2b32e5688aaeb3911c8d3da7927f1569ff2987e60b24c626f0e0295d2f3769e9","tlsh":"1b4188d23eb49574d5b3605099a6de42e727f00b56c2edd8f04dd7b20f5a03427914f4"},{"path":"package.json","sha256":"4f5838da35ad449c8ec916933d1beb5ee9eb691c0368aeb6adad14483ddcfc09","tlsh":"2ef0a303cc720f3311cd6b66189941016b256d87949c7c2c73cf010c87dc6f519bd58d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-x-1.0.0.tgz","hashes":{"sha1":"d77da3a07d1215614b171b6ffadb6e900f5715c0","sha512_sri":"sha512-mid/WMMlVB8zjKcb30NTYRlCCgw/gRDKoIND2n5sKrasQv3xcgoN2doiPvOiTd1TFriZb5u/NE65nu9eBnjkWg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-x/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017580","import_time":"2026-08-12T15:26:11.582611648Z","modified_time":"2026-08-12T15:07:41Z","sha256":"da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4","source":"amazon-inspector","versions":["1.0.0"]}]}}