MAL-2026-13855

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-k/MAL-2026-13855.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13855
Published
2026-08-12T12:16:35Z
Modified
2026-08-12T12:30:17.949642206Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-k (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69)

package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed, download a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz plus get-pip.py over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract to /tmp/mhddos, pip-install its requirements with --break-system-packages, and run python3 start.py. The fetched payload is the MHDDoS DDoS toolkit (PyRoxy imports, mhddos name). The same scripts also collect installer host identity — id, hostname, WSL/VM/container indicators, $HOME, and command output — base64-encode it, and send it via HTTPS GET query string to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<base64>. Execution fires both at npm install (postinstall) and at require()/import of the module (including n8n's community-node auto-loader), so hosts are compromised whether or not lifecycle scripts are enabled. Payload staging paths are disguised under /assets/cache/.theme-backup/dl/ and the exfil endpoint is named /portfolio-data.php as a cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017402",
            "import_time": "2026-08-12T12:24:10.121876337Z",
            "sha256": "98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T12:16:35Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-k

Package

Name
@years18/n8n-nodes-utils-helper-k
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-k

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "e04166b91261a138457371942f2bdb1a956ff10750c4aec8f74e43b38f1252c992b66c",
            "sha256": "8652c6eb26f419729cae5eaa04db4fea4d8c06a7d784fe3372247472b5d9c529"
        },
        {
            "path": "index.js",
            "tlsh": "e04166b91261a138457371942f2bdb1a956ff10750c4aec8f74e43b38f1252c992b66c",
            "sha256": "8652c6eb26f419729cae5eaa04db4fea4d8c06a7d784fe3372247472b5d9c529"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-k-1.0.0.tgz",
            "hashes": {
                "sha1": "f9d74d71aaa64ca33b4b1f648565417e3223006b",
                "sha512_sri": "sha512-KhGACAb30BPLSaI58U+FLT8J6Tpapkt1DPC+p72NncMu7L0jgC7yhWv0giFeNRM1s9lvhy9E//I6hPbbsxziRg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-k/MAL-2026-13855.json"