{"id":"MAL-2026-13874","summary":"Malicious code in @years17/n8n-nodes-utils-helper-e (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096)\nOn install, this package auto-executes callback.js via a postinstall hook (identical to index.js). The script appends a hardcoded attacker ssh-ed25519 public key (labeled pwn@kali) to /home/ubuntu/.ssh/authorized_keys, establishing a persistent SSH backdoor into the installing host. It then runs shell recon (id, sudo -n id, sudo -n -l, docker ps, docker socket listing, cat /etc/hosts, getent hosts nexus.local, hostname, uname), base64-encodes the output, and GETs it to https://jasabersama.id/portfolio-data.php with TLS validation disabled (rejectUnauthorized: false). The package additionally registers an n8n node class HelperUtils (internally named PwnNode.node.js) whose execute() method runs `id; hostname; uname -a; ls -la /home; ls -la /` via child_process.execSync and returns the output with a pwned: true marker.\n","modified":"2026-08-12T13:00:14.533355838Z","published":"2026-08-12T12:37:37Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017551","import_time":"2026-08-12T12:51:49.69915607Z","modified_time":"2026-08-12T12:37:37Z","sha256":"af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-e/v/1.0.0"}],"affected":[{"package":{"name":"@years17/n8n-nodes-utils-helper-e","ecosystem":"npm","purl":"pkg:npm/%40years17/n8n-nodes-utils-helper-e"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-e/MAL-2026-13874.json","indicators":{"package_integrity":[{"hashes":{"sha1":"2a4cb5c4ca7d28d4845b78570eea717d5e036256","sha512_sri":"sha512-vbiBnMgJARz5/RzlyvdabubVaxhetS3zB3FIx5d/kNGlPirPKsyISGXPOg9doisaocVQu3tmV2cO3S24kz6RMw=="},"filename":"n8n-nodes-utils-helper-e-1.0.0.tgz"}],"evidence_files":[{"tlsh":"2f2146f532785d708bf4c5931d5f95b6f49b910316b278c4e0cc48a52bc799846329bd","path":"callback.js","sha256":"2adf8b78ec9205232c34c87fb59a5850f107f06a448df2b105b4a74a8ef9ae3f"},{"path":"nodes/PwnNode.node.js","sha256":"b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059","tlsh":"fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}