@years20/n8n-nodes-utils-helper-g

{"modified":"2026-08-12T15:40:27Z","published":"2026-08-12T15:40:27Z","schema_version":"1.7.4","id":"MAL-2026-13916","summary":"Malicious code in @years20/n8n-nodes-utils-helper-g (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133)\nOn `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS certificate validation disabled (`rejectUnauthorized: false`). The request includes a static key parameter `k=S7k9xQ2mZj` and a `c=` parameter containing a shell command payload (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"@years20/n8n-nodes-utils-helper-g"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"d5d2241459727b04725af5d47259ee52980a473b2746cf7ac8966a0faf305a4d","tlsh":"3f2123fd6360d23015a370946bbefe16dc9bf90f0495bfc8b10d09b3075286c56415b8"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-g-1.0.0.tgz","hashes":{"sha1":"95c07a2af8b115767d58756cfedb2299b3ead81f","sha512_sri":"sha512-zBpYP+Ckd7w5Igt57nMJY1QZ/ow6ymTJg/4jI+DDRTrmtiD4+6NHojTSbV/nZAvAy+XL19xM9EA0hBsf3ug81g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-g/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017613","import_time":"2026-08-12T15:53:00.90021593Z","modified_time":"2026-08-12T15:40:27Z","sha256":"55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133","source":"amazon-inspector","versions":["1.0.0"]}]}}