MAL-2026-13867

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-w/MAL-2026-13867.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13867
Published
2026-08-12T12:15:20Z
Modified
2026-08-12T12:30:13Z
Summary
Malicious code in @years18/n8n-nodes-utils-helper-w (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab)

This package presents itself as an n8n workflow helper but ships a near-empty node stub (nodes/PwnNode.node.js, ~213 bytes) while its postinstall hook and main entry carry a hostile payload. package.json declares postinstall: node callback.js, and index.js is a byte-identical copy of callback.js, so both npm install and require() execute the same code. The payload runs id and hostname, probes for Python packages, executes a staged tool at /tmp/mhddos/start.py (the MHDDoS attack toolkit), base64-encodes the aggregated output, and sends it as a URL query parameter to https://jasabersama.id/portfolio-data.php over HTTPS with TLS verification disabled (rejectUnauthorized:false). It also runs python3 -m pip install --quiet --break-system-packages impacket, mutating the installer's system Python environment, and executes attacker-staged code from /tmp. The mismatch between the advertised n8n-helper purpose and the shipped functionality — plus duplication of the payload across both auto-executed surfaces — indicates the declared purpose is a cover for the attack.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017393",
            "import_time": "2026-08-12T12:24:09.137517631Z",
            "modified_time": "2026-08-12T12:15:20Z",
            "sha256": "5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years18/n8n-nodes-utils-helper-w

Package

Name
@years18/n8n-nodes-utils-helper-w
View open source insights on deps.dev
Purl
pkg:npm/%40years18/n8n-nodes-utils-helper-w

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "4e3b8c5eb59ae45053e07d90e2e09f4a5d16670876330c8dd3f152ccc3527bd4",
            "tlsh": "5521f0f51201e1348572f0a4ba6bde56f86ff70310dab5c8f10e86b34b125596b135a8"
        },
        {
            "path": "index.js",
            "sha256": "4e3b8c5eb59ae45053e07d90e2e09f4a5d16670876330c8dd3f152ccc3527bd4",
            "tlsh": "5521f0f51201e1348572f0a4ba6bde56f86ff70310dab5c8f10e86b34b125596b135a8"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-w-1.0.0.tgz",
            "hashes": {
                "sha1": "a69f2e18f3d85c0ae78d9ec9e5ea143fba1008e7",
                "sha512_sri": "sha512-eEfyAOBXWOPcWirvV09XRkbbVJfAwjqnwPz/T9EqN5j1U5JlPxlv5R1FbkWKl2gMUIxCxGPE6QlnGkrKB2UMlw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years18/n8n-nodes-utils-helper-w/MAL-2026-13867.json"