{"id":"MAL-2026-13904","summary":"Malicious code in @years19/n8n-nodes-utils-helper-u (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5)\nThe package's postinstall hook (callback.js) and its declared main entry (index.js, byte-identical to callback.js) both write a Python script to /tmp/attack.py and spawn it via `nohup python3 /tmp/attack.py... &`. The script launches hundreds of UDP/TCP flood threads against the hardcoded target 103.118.252.21 for 600 seconds, turning the installer's host into a DDoS source against a third party. After launching the flood, the code collects host identifiers (`id`, `hostname`, running process count, /proc/loadavg), base64-encodes them, and issues an HTTPS GET to jasabersama.id/portfolio-data.php with query parameters `k=S7k9xQ2mZj&c=\u003cbase64\u003e`, with TLS certificate verification disabled (`rejectUnauthorized: false`). Because index.js is the module's main entry, the same dropper also fires whenever the package is `require`d — for example when loaded as an n8n community node — in addition to firing on `npm install` via the postinstall lifecycle hook.\n","modified":"2026-08-12T15:30:15.046852652Z","published":"2026-08-12T15:08:06Z","database_specific":{"malicious-packages-origins":[{"sha256":"c82adb424b76ab7db887024cb8608a8e7aa3b942797ba38a3eef74fa36c249e5","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017583","import_time":"2026-08-12T15:26:11.778643971Z","modified_time":"2026-08-12T15:08:06Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-u/v/1.0.0"}],"affected":[{"package":{"name":"@years19/n8n-nodes-utils-helper-u","ecosystem":"npm","purl":"pkg:npm/%40years19/n8n-nodes-utils-helper-u"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"n8n-nodes-utils-helper-u-1.0.0.tgz","hashes":{"sha1":"357636d068cdfeb28911309de68bc4fb9400faee","sha512_sri":"sha512-dmcL6Pn3Q+sH7FhG4gEZuql362QqYaAf78DKT3orGEx4zYEYjYdEl44GP65y1vPYL0XnUCrik59qeZAh7juO0w=="}}],"evidence_files":[{"path":"callback.js","sha256":"2d4a88d7ac61db1d7d9afad967897f9a65e2e2556019e3711f7749d0471ba641","tlsh":"174183e33ab89434d5b32090a8a6ee42a627b10b5586fdd8f04dd6b20f6b03827914f4"},{"tlsh":"174183e33ab89434d5b32090a8a6ee42a627b10b5586fdd8f04dd6b20f6b03827914f4","path":"index.js","sha256":"2d4a88d7ac61db1d7d9afad967897f9a65e2e2556019e3711f7749d0471ba641"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-u/MAL-2026-13904.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}