MAL-2026-13858

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-n/MAL-2026-13858.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13858
Published
2026-08-12T12:16:21Z
Modified
2026-08-12T12:30:16.514131994Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-n (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98)

The package's postinstall script (callback.js) and its declared main (index.js) both fetch two tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ (mhddos.tgz and pyroxy.tgz) over an HTTPS connection with certificate verification disabled (rejectUnauthorized:false), extract mhddos.tgz to /tmp/mhddos and pyroxy.tgz into the installer's Python site-packages, force-install a set of unpinned Python packages using python3 -m pip install --break-system-packages (pysocks, cloudscraper, dnspython, psutil, icmplib, pyasn1, yarl, requests_toolbelt, certifi), and then execute python3 start.py from the extracted MHDDoS directory. Separately, the same script collects the output of id and hostname, base64-encodes the result, and issues an HTTPS GET to jasabersama.id/portfolio-data.php with a hardcoded key parameter, providing the operator of that host a per-install beacon carrying installer identity. Because the dropper logic is duplicated in index.js, any consumer that does require('@years18/n8n-nodes-utils-helper-n') re-triggers the fetch, extraction, pip install, DDoS launcher, and beacon in addition to the automatic postinstall execution. The advertised package name imitates the n8n community-node namespace; the shipped code has no relation to an n8n node.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017400",
            "import_time": "2026-08-12T12:24:09.91560672Z",
            "sha256": "f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98",
            "modified_time": "2026-08-12T12:16:21Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-n

Package

Name
@years18/n8n-nodes-utils-helper-n
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-n

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "8f4198b61252a538403363586f2bdd66d66fb10784d8bac8f64d43730f129386d5b76c",
            "sha256": "939b22deea396f3518d6d974069b37918201181f7ce418fdac8cf4ad161f7f6c"
        },
        {
            "path": "index.js",
            "tlsh": "8f4198b61252a538403363586f2bdd66d66fb10784d8bac8f64d43730f129386d5b76c",
            "sha256": "939b22deea396f3518d6d974069b37918201181f7ce418fdac8cf4ad161f7f6c"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-n-1.0.0.tgz",
            "hashes": {
                "sha1": "5a93b29f8b929a6e2fd73201c9639b3ee6994ccb",
                "sha512_sri": "sha512-mcm+VuecMgxY3tCJXqlJq4/pZRNMwHOgvprrMjvWfr582JoSdc4fqEgvkNdatXCAa4LwFrsIgOX5HMZIPrqIAw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-n/MAL-2026-13858.json"