MAL-2026-13857

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-m/MAL-2026-13857.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13857
Published
2026-08-12T12:16:28Z
Modified
2026-08-12T12:30:14.921875826Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-m (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53)

The package's declared postinstall script (node callback.js) and its main entrypoint (index.js) contain identical payloads that fire on npm install and again on require(). The payload downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy.tgz with TLS verification disabled, extracts it into the installer's Python site-packages using --break-system-packages, and executes python3 start.py from /tmp/mhddos (the mhddos / PyRoxy DDoS tool). The same code collects the installer's user id, hostname, and command-execution output, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=..., again with rejectUnauthorized: false. The package name mimics an n8n community-nodes helper but its shipped code performs no such functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017401",
            "import_time": "2026-08-12T12:24:10.027840455Z",
            "sha256": "5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53",
            "modified_time": "2026-08-12T12:16:28Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-m

Package

Name
@years18/n8n-nodes-utils-helper-m
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-m

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "c64175b51262e634853362646f1bde76d66fb50358c8bec8f24d43730f128387e6a66c",
            "sha256": "821bbd9ed8e5d7a6fe0aef9478701c941545b83583ab1f70cf643ac3b72cbb6a"
        },
        {
            "path": "index.js",
            "tlsh": "c64175b51262e634853362646f1bde76d66fb50358c8bec8f24d43730f128387e6a66c",
            "sha256": "821bbd9ed8e5d7a6fe0aef9478701c941545b83583ab1f70cf643ac3b72cbb6a"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-m-1.0.0.tgz",
            "hashes": {
                "sha1": "9ec6f8c229865c4f4f76b05c7e52876add2a9410",
                "sha512_sri": "sha512-Phd7JvVdjnBm+DYfUGyf78egYSysQosZwAzocKDc6wH4ssACTLPH7/QfMFSb8KLCszgFBnaYYiydv1PW9K7UpA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-m/MAL-2026-13857.json"