MAL-2026-13863

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-s/MAL-2026-13863.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13863
Published
2026-08-12T12:15:28Z
Modified
2026-08-12T12:30:14.925717057Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-s (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342)

The package's postinstall lifecycle script downloads two tarballs (mhddos.tgz, pyroxy.tgz) from jasabersama.id over an HTTPS connection with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp and into the Python user site-packages, pip-installs a fixed dependency set with --break-system-packages, and immediately runs python3 start.py from the extracted mhddos directory. In parallel, it collects the output of id and hostname plus install-progress markers, base64-encodes them, and sends them as a query-string parameter to https://jasabersama.id/portfolio-data.php with a fixed key S7k9xQ2mZj. The payload URL is staged under a .theme-backup/dl/ cover-story path on a domain unrelated to the package's declared purpose, and the package's n8n node file is a stub — the sole functional code is the malicious postinstall. The name mimics legitimate n8n community node packages.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-12T12:24:09.251224206Z",
            "sha256": "791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342",
            "modified_time": "2026-08-12T12:15:28Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017394",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-s

Package

Name
@years18/n8n-nodes-utils-helper-s
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-s

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-s/MAL-2026-13863.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "386ff7324fc13471de7a3cb987a733b8a498411ea72de40bfbe8806b330def50",
            "path": "callback.js",
            "tlsh": "3941b9b51261a638803362687f2bdd66e23bf10754c5bac8fa4d43b35f019345d2a768"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-s-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-gfPwZdSXxYHgpmv8kh+k5+nPQF/ssiL7csp6LJ/cCH4K7UDSYlYgRfRcFNoxXfUSBlDzGiijrrHIzNUys2k5BQ==",
                "sha1": "cc4f38b4c09a290475d1597338d33c41aa0dd5cb"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]