@years20/n8n-nodes-utils-helper-b

{"modified":"2026-08-12T15:10:02Z","published":"2026-08-12T15:10:02Z","schema_version":"1.7.4","id":"MAL-2026-13910","summary":"Malicious code in @years20/n8n-nodes-utils-helper-b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60)\nOn npm install (postinstall) and on require/import of the package's main entry, callback.js and index.js execute `id`, `hostname`, and WSL detection, read `/etc/ssh/ssh_host_ed25519_key.pub`, base64-encode the collected data, and GET it to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<base64-command>` with TLS verification disabled (`rejectUnauthorized: false`). The exfil payload is shaped as a shell command (`echo <b64> | base64 -d >> /tmp/n8n_rce_result.txt`) consistent with a replayable C2 handler. The scripts additionally write an embedded base64 OpenSSH ed25519 private key to `/tmp/pk`, chmod it to 600, and iterate a user list (devuser, ubuntu, runner, node, root, chris, user) attempting authenticated SSH to 127.0.0.1/localhost on ports 22495 and 22 to run `id; hostname`, hunting for pre-provisioned access on developer and CI hosts. Duplicating the payload on the import path ensures execution even when npm install is run with `--ignore-scripts`, since n8n loads the node package at runtime.\n","affected":[{"package":{"ecosystem":"npm","name":"@years20/n8n-nodes-utils-helper-b"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978","tlsh":"325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"},{"path":"index.js","sha256":"8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978","tlsh":"325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-b-1.0.0.tgz","hashes":{"sha1":"a1f32be8c227aa11604d056268d5082f07d84f59","sha512_sri":"sha512-Y1HvO2QI6yFL5pP55qEdnhke4TRLM7jGFGRSfwSL5lrlyR9sGsBmXKwFtZjj5+LDHK6IZPWxv4vSfyM3D+zKJA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-b/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017597","import_time":"2026-08-12T15:26:13.086364953Z","modified_time":"2026-08-12T15:10:02Z","sha256":"5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60","source":"amazon-inspector","versions":["1.0.0"]}]}}