MAL-2026-13865

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-u/MAL-2026-13865.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13865
Published
2026-08-12T12:15:35Z
Modified
2026-08-12T12:30:12.136685483Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-u (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df)

The package's postinstall script (duplicated as the main module) runs unconditionally on npm install. It executes id and hostname, base64-encodes the output, and transmits it as a query-string parameter to a hardcoded HTTPS endpoint at jasabersama.id/portfolio-data.php with TLS certificate validation explicitly disabled (rejectUnauthorized: false). The same lifecycle hook installs the Python impacket package system-wide via pip --break-system-packages and invokes /tmp/mhddos/start.py, an MHDDoS attack launcher, weaponizing the installer host for outbound denial-of-service activity. The URL also carries a c= parameter conveying a shell command that decodes attacker-controlled bytes into /tmp/n8n_rce_result.txt, providing a command-staging channel back to the same remote endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017395",
            "import_time": "2026-08-12T12:24:09.362214915Z",
            "sha256": "2e6a7fb247eadeb1f59c123721fdc49078bb1b723f80ed10f2a29c1c04eb04df",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T12:15:35Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-u

Package

Name
@years18/n8n-nodes-utils-helper-u
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-u

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "5521f0f51201e1348572f0a4ba6bde56f86ff70310dab5c8f10e86b34b125596b135a8",
            "sha256": "4e3b8c5eb59ae45053e07d90e2e09f4a5d16670876330c8dd3f152ccc3527bd4"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-u-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-DRCoPFry1IGLjuiWV1pVwPBHm4WADYJw2fvwPPvo6VKKt6lknunjyyWOEpM8UCSezDc76hKNuvmXKgh+ibit5w==",
                "sha1": "604b1a0744e6c12dbe736c4b8965a0bf0f8143c4"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-u/MAL-2026-13865.json"