{"id":"MAL-2026-13916","summary":"Malicious code in @years20/n8n-nodes-utils-helper-g (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133)\nOn `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS certificate validation disabled (`rejectUnauthorized: false`). The request includes a static key parameter `k=S7k9xQ2mZj` and a `c=` parameter containing a shell command payload (`echo \u003cbase64\u003e | base64 -d \u003e\u003e /tmp/n8n_rce_result.txt`), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.\n","modified":"2026-08-12T16:03:34.348716842Z","published":"2026-08-12T15:40:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-12T15:53:00.90021593Z","modified_time":"2026-08-12T15:40:27Z","sha256":"55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017613"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-g/v/1.0.0"}],"affected":[{"package":{"name":"@years20/n8n-nodes-utils-helper-g","ecosystem":"npm","purl":"pkg:npm/%40years20/n8n-nodes-utils-helper-g"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-zBpYP+Ckd7w5Igt57nMJY1QZ/ow6ymTJg/4jI+DDRTrmtiD4+6NHojTSbV/nZAvAy+XL19xM9EA0hBsf3ug81g==","sha1":"95c07a2af8b115767d58756cfedb2299b3ead81f"},"filename":"n8n-nodes-utils-helper-g-1.0.0.tgz"}],"evidence_files":[{"path":"callback.js","sha256":"d5d2241459727b04725af5d47259ee52980a473b2746cf7ac8966a0faf305a4d","tlsh":"3f2123fd6360d23015a370946bbefe16dc9bf90f0495bfc8b10d09b3075286c56415b8"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-g/MAL-2026-13916.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}