@years20/n8n-nodes-utils-helper-f

{"modified":"2026-08-12T15:09:54Z","published":"2026-08-12T15:09:54Z","schema_version":"1.7.4","id":"MAL-2026-13914","summary":"Malicious code in @years20/n8n-nodes-utils-helper-f (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7)\nThe package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callback.js) and on require (identical top-level code in index.js). The payload collects host identity (id, hostname, network interfaces, WSL detection), reads the SSH host public key from /etc/ssh/ssh_host_ed25519_key.pub, and probes internal-network ports including 10.131.106.231:22495. The aggregated data is base64-encoded and sent via https.get to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The package name suggests it is masquerading as an n8n helper node, but the shipped code has no n8n functionality — only the recon/exfil payload.\n","affected":[{"package":{"ecosystem":"npm","name":"@years20/n8n-nodes-utils-helper-f"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c","tlsh":"783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4"},{"path":"index.js","sha256":"75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c","tlsh":"783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-f-1.0.0.tgz","hashes":{"sha1":"ac3995b62ec65d0461f31c7a3a6297a46643050a","sha512_sri":"sha512-PB9MewvGZ5Jru/63IWvn5xdP9eRe1D2L0Kwb914cq0sOi4ZghV7/hBTYWUTf/WvUI8PEKezeSmXja/QJRnWV9w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-f/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017596","import_time":"2026-08-12T15:26:12.996188284Z","modified_time":"2026-08-12T15:09:54Z","sha256":"c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7","source":"amazon-inspector","versions":["1.0.0"]}]}}