{"id":"MAL-2026-13900","summary":"Malicious code in @years19/n8n-nodes-utils-helper-q (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a)\nPackage @years19/n8n-nodes-utils-helper-q@1.0.0 ships two byte-identical top-level scripts (callback.js and index.js). package.json declares \"main\":\"index.js\" and \"postinstall\":\"node callback.js\", so the same payload fires both on npm install and on any require()/import of the package. On execution the scripts download multiple tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract them under /tmp, and spawn python3 start.py in the background to launch UDP/TCP/GET flood traffic against 103.118.252.21 — turning the installer's machine into a DDoS attack node. Separately, the scripts run `id` and `hostname`, base64-encode the output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating installer host identity to a hardcoded attacker-controlled endpoint. Multiple auto-execution paths, TLS validation disabled, and an unrelated non-publisher host delivering opaque archives that are then executed match a canonical install-time RCE / dropper with concurrent host abuse and exfiltration.\n","modified":"2026-08-12T15:30:12.138550397Z","published":"2026-08-12T15:07:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-12T15:26:11.277310628Z","modified_time":"2026-08-12T15:07:04Z","sha256":"ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017576"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-q/v/1.0.0"}],"affected":[{"package":{"name":"@years19/n8n-nodes-utils-helper-q","ecosystem":"npm","purl":"pkg:npm/%40years19/n8n-nodes-utils-helper-q"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"callback.js","sha256":"9f7f0b9b6e69f8174b545382d7c38dba3fed850da59ab0de0790e8d6f39510b7","tlsh":"ca5163f41a20743c023351685a17fc69d62fa30b1890f9d9fb8e56b2ab05a18c71bf75"},{"path":"index.js","sha256":"9f7f0b9b6e69f8174b545382d7c38dba3fed850da59ab0de0790e8d6f39510b7","tlsh":"ca5163f41a20743c023351685a17fc69d62fa30b1890f9d9fb8e56b2ab05a18c71bf75"}],"package_integrity":[{"filename":"n8n-nodes-utils-helper-q-1.0.0.tgz","hashes":{"sha1":"2e4731f21b42a1e7acd732410eb90944c0d15a1e","sha512_sri":"sha512-FZfGi6zvVuinLy7ab8ng8l1dbYcvUBKlqR9yx5qs7HzQ6BGHKYkHf3BIYS/Tfk0h82+iVOLAhF8/VasqVvQpGg=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-q/MAL-2026-13900.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}