{"id":"MAL-2026-13887","summary":"Malicious code in @years19/n8n-nodes-utils-helper-d (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7)\nThe package presents itself as an n8n community node (`n8n-nodes-utils-helper-d`) but its actual on-install behavior is unrelated to workflow automation. The postinstall script fetches a tarball from `https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz` over an HTTPS connection with TLS certificate validation disabled (`rejectUnauthorized:false`) and extracts it into the user's Python site-packages, shadowing the real `multidict` module so subsequent `import multidict` in the environment executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and `/tmp/mhddos/start.py`, consistent with a DDoS / offensive-tooling dropper. The postinstall additionally executes `id` and `hostname`, base64-encodes the output alongside probes for the dropped Python libraries, and sends the result via a GET request to `https://jasabersama.id/portfolio-data.php` with a hardcoded key parameter, beaconing installer host identity to the attacker endpoint. The shipped node file is a stub named `PwnNode.node.js`, and no legitimate n8n node functionality is present.\n","modified":"2026-08-12T15:30:14.999745035Z","published":"2026-08-12T15:10:45Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017602","import_time":"2026-08-12T15:26:13.683532197Z","modified_time":"2026-08-12T15:10:45Z","sha256":"72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-d/v/1.0.0"}],"affected":[{"package":{"name":"@years19/n8n-nodes-utils-helper-d","ecosystem":"npm","purl":"pkg:npm/%40years19/n8n-nodes-utils-helper-d"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-d/MAL-2026-13887.json","indicators":{"evidence_files":[{"tlsh":"194154f5121192344033b2b46b2bdea6e66bb60754d5bdc8f14c43731f229285e176bc","path":"callback.js","sha256":"da96b263acf0c54a1c0a7a3529def1779f10a970f6c8eb9a1a4925770066fad2"},{"sha256":"80a9429c4df8ec0d8e05b2d20109441985d3d3971aac9cdb545ea5a5b209927e","tlsh":"21f0ab038c720f3321cdab66189a8101ab246e8b949c7c2c73cf010c87dc7f52abe68d","path":"package.json"}],"package_integrity":[{"hashes":{"sha1":"3f008ce704cd7c4396ee4250bd237da3a82eb4e5","sha512_sri":"sha512-eXsPN7FjzOfWMHJh2SkVOo/Jh4aFyk9Ia4q2jr+VDuokIxv3bJgt7TM8eo9G+spuASq0hbkRiUlblSxUHxivFQ=="},"filename":"n8n-nodes-utils-helper-d-1.0.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}