MAL-2026-13870

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper/MAL-2026-13870.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13870
Published
2026-08-12T12:38:25Z
Modified
2026-08-12T13:00:17.607603852Z
Summary
Malicious code in @years17/n8n-nodes-utils-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2)

The package's postinstall script (also executed on require() via index.js) runs a series of host reconnaissance commands (id, hostname, uname -a, docker socket check, sudo -l, docker ps, listings of /home/ubuntu and /root, contents of ~ubuntu/.ssh/authorizedkeys, and env vars filtered by docker|n8n|secret|token|key|pass), base64-encodes the output, and transmits it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). Additionally, a bundled n8n node (PwnNode) exposes an execute() method that runs id; hostname; uname -a; ls -la /home; ls -la / via childprocess.execSync and returns the output as { pwned: true, result:... }, providing an operator-triggered host reconnaissance primitive inside any n8n workflow that uses the node. The package advertises itself as a utility helper but its only functionality is host reconnaissance, secret harvesting, and exfiltration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-12T12:51:50.078261003Z",
            "id": "IN-MAL-2026-017557",
            "sha256": "14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2",
            "modified_time": "2026-08-12T12:38:25Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017560",
            "import_time": "2026-08-12T12:51:50.350798176Z",
            "sha256": "33674f60359931b9c96e34c258b3f79ac9bcf0a0f98bbe4c172004e10e138c90",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T12:38:47Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years17/n8n-nodes-utils-helper

Package

Name
@years17/n8n-nodes-utils-helper
View open source insights on deps.dev
Purl
pkg:npm/%40years17/n8n-nodes-utils-helper

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "8d1142f9367c8d308af0c4d75d4b9a5bd09bd10366b2b9c8e08c09952fcb95840134fd",
            "sha256": "669e2b699905aaea1f583b077ba97eac1ffc35d7b47a70425caed7ccdd4a9d98"
        },
        {
            "path": "nodes/PwnNode.node.js",
            "tlsh": "fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8",
            "sha256": "b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-1.0.1.tgz",
            "hashes": {
                "sha1": "e9f46575fd1e195322aeef31fad188a374bd4663",
                "sha512_sri": "sha512-CpEvSQVwi9RhzXbS8O+34yAx39ov3IxnN47uv1HgVOeG9+qq7GHCNg5HqrmRh+HfAzuKXHkL2EVb8U0geF61ng=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper/MAL-2026-13870.json"