{"id":"MAL-2026-13914","summary":"Malicious code in @years20/n8n-nodes-utils-helper-f (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7)\nThe package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callback.js) and on require (identical top-level code in index.js). The payload collects host identity (id, hostname, network interfaces, WSL detection), reads the SSH host public key from /etc/ssh/ssh_host_ed25519_key.pub, and probes internal-network ports including 10.131.106.231:22495. The aggregated data is base64-encoded and sent via https.get to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The package name suggests it is masquerading as an n8n helper node, but the shipped code has no n8n functionality — only the recon/exfil payload.\n","modified":"2026-08-12T15:30:15.001218757Z","published":"2026-08-12T15:09:54Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-017596","import_time":"2026-08-12T15:26:12.996188284Z","modified_time":"2026-08-12T15:09:54Z","sha256":"c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-f/v/1.0.0"}],"affected":[{"package":{"name":"@years20/n8n-nodes-utils-helper-f","ecosystem":"npm","purl":"pkg:npm/%40years20/n8n-nodes-utils-helper-f"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c","tlsh":"783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4","path":"callback.js"},{"sha256":"75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c","tlsh":"783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"ac3995b62ec65d0461f31c7a3a6297a46643050a","sha512_sri":"sha512-PB9MewvGZ5Jru/63IWvn5xdP9eRe1D2L0Kwb914cq0sOi4ZghV7/hBTYWUTf/WvUI8PEKezeSmXja/QJRnWV9w=="},"filename":"n8n-nodes-utils-helper-f-1.0.0.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-f/MAL-2026-13914.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}