MAL-2026-13871

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-b/MAL-2026-13871.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13871
Published
2026-08-12T12:38:38Z
Modified
2026-08-12T13:00:18.614110481Z
Summary
Malicious code in @years17/n8n-nodes-utils-helper-b (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397)

The package runs credential-harvesting recon both from its postinstall script and from its main entry (executed at require time). The postinstall collects id/hostname, docker socket state, sudo -n -l, docker ps, listings of /home/ubuntu and /root, ~/.ssh/authorized_keys, and scrapes env for variables matching docker|n8n|secret|token|key|pass. The main module additionally reads ~/.kube/config, ~/.ssh/authorized_keys, and ~/.config/gcloud/application_default_credentials.json, plus SSH directory listing and crontab. In both paths the aggregate output is base64-encoded and sent as the c= query-string parameter to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj via https.request with rejectUnauthorized:false (TLS verification disabled). The package additionally ships an n8n node (nodes/PwnNode.node.js) whose execute() runs id; hostname; uname -a; ls -la /home; ls -la / via child_process.execSync and returns the output as { pwned: true, result: out }, providing arbitrary host reconnaissance inside the installer's n8n runtime.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-12T12:51:50.228104825Z",
            "sha256": "55dc5bbe5a3b2dfb5bf97920ee68027b585bc2b21f4388e88a25986318754397",
            "modified_time": "2026-08-12T12:38:38Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017559",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years17/n8n-nodes-utils-helper-b

Package

Name
@years17/n8n-nodes-utils-helper-b
View open source insights on deps.dev
Purl
pkg:npm/%40years17/n8n-nodes-utils-helper-b

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-b/MAL-2026-13871.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "669e2b699905aaea1f583b077ba97eac1ffc35d7b47a70425caed7ccdd4a9d98",
            "tlsh": "8d1142f9367c8d308af0c4d75d4b9a5bd09bd10366b2b9c8e08c09952fcb95840134fd",
            "path": "callback.js"
        },
        {
            "sha256": "65c43ef8e35925d41e4368dd3ac9653fa898a55980afec20b21195f0167d9208",
            "tlsh": "cd2154f6337c9a300bb5c5575d5fa256e4db810214b6b5cce0cc4d452fcb98c41129f4",
            "path": "index.js"
        },
        {
            "sha256": "b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059",
            "path": "nodes/PwnNode.node.js",
            "tlsh": "fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-b-1.0.0.tgz",
            "hashes": {
                "sha1": "aaebce20f950fae962dbc542495d5f6e1aa8e824",
                "sha512_sri": "sha512-iveDokxEDQOaqD6hxeQ11arZMYRRX2u54rlwbozr1VVig5Jc8fhUzKgx4GN2gx5uI19XKbPgEScPJJ6qFBMU3g=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]