@years20/n8n-nodes-utils-helper-i

{"modified":"2026-08-12T15:40:18Z","published":"2026-08-12T15:40:18Z","schema_version":"1.7.4","id":"MAL-2026-13918","summary":"Malicious code in @years20/n8n-nodes-utils-helper-i (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30)\nThe package presents itself as an n8n helper node but ships only a stub node (nodes/PwnNode.node.js) and a postinstall script (callback.js, duplicated as index.js) that performs installer-side reconnaissance and exfiltration on npm install. The postinstall shells out to collect user id, hostname, git configuration, running n8n processes, and locations of.n8n directories, base64-encodes the output, and sends it via HTTPS GET to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same postinstall performs an unpinned git clone of a personal GitHub repository (github.com/yadhukrishnam/CVE-2026-25053) into /tmp/gh-test during install, fetching third-party content unrelated to the package publisher on mutable HEAD. The referenced repository name embeds a CVE identifier consistent with an n8n supply-chain proof-of-concept payload.\n","affected":[{"package":{"ecosystem":"npm","name":"@years20/n8n-nodes-utils-helper-i"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"6f7d31df79c97297540362b4ba5d81ae984d96cf4f653b328dd78569089b8151","tlsh":"4a2161f95210e5705463b0a06e7fff46e8afba0704cdeec8f14d06730b228a82b4656c"},{"path":"package.json","sha256":"1c1f0a5b893b29e637acab981cede40c9ff48bd6803e6fd0f26ef52f90528c46","tlsh":"7ff0a3028c720f3311cd6b6b18994141aa246e97949c7c2c73cf010c87dc6f519bd58d"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-i-1.0.0.tgz","hashes":{"sha1":"15b0ad35aeffc19aefa0bc3051aa96a945e63645","sha512_sri":"sha512-SqFQFtPll0FI0ASq/7PWY6DELJXa7/OLvzmxDqvIUiAPSCZiBqEy6SxYNW9oNA2Re/+PEBwZ1X3l8Rmf6hrZKg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-i/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017612","import_time":"2026-08-12T15:53:00.808321345Z","modified_time":"2026-08-12T15:40:18Z","sha256":"a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30","source":"amazon-inspector","versions":["1.0.0"]}]}}