{"id":"MAL-2026-13848","summary":"Malicious code in @years18/n8n-nodes-utils-helper-b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe)\nThe package declares itself as a workflow-automation helper but its postinstall script (`node callback.js`) fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over a TLS-verification-disabled HTTPS connection, extracts it to /tmp/mhddos, installs its Python requirements, and executes `python3 start.py`. In parallel, the script collects installer host identity (`id`, `hostname`) and the output of the tar/pip/execute steps, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate validation disabled). The remote path is staged under a decoy `/assets/cache/.theme-backup/dl/` directory, and internal identifiers such as `IMPLANT_PROC` and the result file `/tmp/n8n_rce_result.txt` correspond to implant behavior rather than a helper library. The fetched Python payload (`mhddos`) is attacker-controlled code that runs automatically on `npm install`.\n","modified":"2026-08-12T12:30:17.964205833Z","published":"2026-08-12T12:17:43Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-12T12:17:43Z","sha256":"2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017410","import_time":"2026-08-12T12:24:10.947549492Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-b/v/1.0.0"}],"affected":[{"package":{"name":"@years18/n8n-nodes-utils-helper-b","ecosystem":"npm","purl":"pkg:npm/%40years18/n8n-nodes-utils-helper-b"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"cf0e44498e1d3fbd955c79af1325c3ed580fa889af40a7b74deffe8351be0c2a","tlsh":"704153b923629538913361ac7b27d90bf45bf1078094eec8f68e4bb3cf114185a56669"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-b-1.0.0.tgz","hashes":{"sha1":"e1d0c8be99bb76393319c97712447a50f2434f25","sha512_sri":"sha512-9uZIufdVWoer25UrLUDjK3E4aTY22MmrUHAtIN09HuhJomg0ZGXK0tceS4+SwXCD1KJQnEeY+tAqbHKizptl8w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-b/MAL-2026-13848.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}