@years20/n8n-nodes-utils-helper-d

{"modified":"2026-08-12T15:07:33Z","published":"2026-08-12T15:07:33Z","schema_version":"1.7.4","id":"MAL-2026-13912","summary":"Malicious code in @years20/n8n-nodes-utils-helper-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8)\nThe package runs a hostile payload both from its declared postinstall hook (`node callback.js`) and at library load via `index.js`, which is byte-identical to `callback.js` and set as `main`. The payload runs `id`, collects the machine hostname, detects WSL, and reads `/etc/ssh/ssh_host_ed25519_key.pub`, then base64-encodes the data and sends it over HTTPS GET to `jasabersama.id/portfolio-data.php` with TLS verification disabled (`rejectUnauthorized: false`). The exfil query wraps the encoded data in a shell command framed as `portfolio-data.php`. The same script decodes a base64-embedded OpenSSH ed25519 private key to `/tmp/pk`, chmods it to 600, and attempts SSH logins to `127.0.0.1:22495` and `127.0.0.1:22` as users `devuser`, `ubuntu`, `runner`, `node`, `root`, `chris`, and `user`, reporting successful authentications back to `jasabersama.id`. Because the payload is duplicated at module load, it also fires when n8n or any consumer performs `require('@years20/n8n-nodes-utils-helper-d')`, bypassing `--ignore-scripts`.\n","affected":[{"package":{"ecosystem":"npm","name":"@years20/n8n-nodes-utils-helper-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978","tlsh":"325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"},{"path":"index.js","sha256":"8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978","tlsh":"325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-d-1.0.0.tgz","hashes":{"sha1":"ff40826df9b2b852044091f2bdace9dc2ffa0de3","sha512_sri":"sha512-7utzYxoBuzRXhD5u0VjB19K/jEVqxM3+a/YFRrn88iadbfbUpHttJiToxT5uDnLM1fE/lt1CGGxCiMBnucEyqw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-d/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017579","import_time":"2026-08-12T15:26:11.522234117Z","modified_time":"2026-08-12T15:07:33Z","sha256":"84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8","source":"amazon-inspector","versions":["1.0.0"]}]}}