{"id":"MAL-2026-13876","summary":"Malicious code in @years17/n8n-nodes-utils-helper-g (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3)\nThe package's postinstall hook runs callback.js, which appends an attacker-controlled ssh-ed25519 public key (labeled pwn@kali) to /home/ubuntu/.ssh/authorized_keys, granting persistent remote SSH access to the installer's host. The same script collects host reconnaissance (id, hostname, sudo -n -l, ls -la /var/run/docker.sock, docker ps, /etc/hosts, internal name resolution for nexus.local), base64-encodes the output, and sends it over HTTPS to jasabersama.id/portfolio-data.php with certificate verification disabled (rejectUnauthorized:false). The exfil URL also carries a c= parameter whose value is a shell command (echo \u003cb64\u003e | base64 -d \u003e\u003e /tmp/n8n_rce_result.txt), consistent with a server-side command handler at the C2 endpoint. In addition, nodes/PwnNode.node.js exposes an n8n node whose execute() runs `id; hostname; uname -a; ls -la /home; ls -la /` via child_process.execSync and returns the output as node JSON (pwned:true), providing a post-exploitation primitive to any workflow that uses the node.\n","modified":"2026-08-12T13:00:14.511652086Z","published":"2026-08-12T12:38:06Z","database_specific":{"malicious-packages-origins":[{"sha256":"3685924a9f7a3a8bbccd7521020a9f1e7ae208f1b991805b2861e4c289a6eaa3","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017555","import_time":"2026-08-12T12:51:49.947001085Z","modified_time":"2026-08-12T12:38:06Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-g/v/1.0.0"}],"affected":[{"package":{"name":"@years17/n8n-nodes-utils-helper-g","ecosystem":"npm","purl":"pkg:npm/%40years17/n8n-nodes-utils-helper-g"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"2adf8b78ec9205232c34c87fb59a5850f107f06a448df2b105b4a74a8ef9ae3f","tlsh":"2f2146f532785d708bf4c5931d5f95b6f49b910316b278c4e0cc48a52bc799846329bd","path":"callback.js"},{"tlsh":"fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8","path":"nodes/PwnNode.node.js","sha256":"b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-g-1.0.0.tgz","hashes":{"sha1":"6f439a4ace520c09d0a874d9159d4856260544e0","sha512_sri":"sha512-Wv9qKBP0t3zgAuvMdI4Lwd7d9bSL8yWiKUvMoXI6weQHu4YwVclGdk07YvdT481696CJnDE8Y6YrQg0ANjDwXQ=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-g/MAL-2026-13876.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}