MAL-2026-13872

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-c/MAL-2026-13872.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13872
Published
2026-08-12T12:38:31Z
Modified
2026-08-12T13:00:22.142653894Z
Summary
Malicious code in @years17/n8n-nodes-utils-helper-c (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24)

The package registers a postinstall script (also duplicated as the main entry) that runs shell reconnaissance on the installer host — id, hostname, whoami, /proc/1/cgroup, environment variables, /etc/os-release, Docker socket presence, and directory listings of /home and /root — base64-encodes the collected output, and transmits it as a URL query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The request also carries a static shared key (k=S7k9xQ2mZj) and a c= parameter shaped as a shell command (echo <b64> | base64 -d >> /tmp/n8nrceresult.txt), consistent with a C2 relay pattern. Separately, the declared n8n node HelperUtils in nodes/PwnNode.node.js executes shell reconnaissance (id; hostname; uname -a; ls -la /home; ls -la /) inside its execute() method and returns the raw output to the workflow — the advertised utility node performs no transformation and only enumerates the host. The package name (utils-helper) and description (Utility helper nodes) do not disclose either behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017558",
            "import_time": "2026-08-12T12:51:50.123770955Z",
            "sha256": "983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T12:38:31Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years17/n8n-nodes-utils-helper-c

Package

Name
@years17/n8n-nodes-utils-helper-c
View open source insights on deps.dev
Purl
pkg:npm/%40years17/n8n-nodes-utils-helper-c

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "4f2174e63178843047f0c4e12d5f64aaf0abe1021ab7f5cce4cc58a52fc282885139f8",
            "sha256": "1596faafa41892e8a98b81f5958a03d6fa33cce3284a05e520b8da3264d8c05d"
        },
        {
            "path": "nodes/PwnNode.node.js",
            "tlsh": "fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8",
            "sha256": "b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-c-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-Yt7q+ZtOqaDWR7kh1WWPB4v07LhYO1c6BCTWTZ8cEPNwY64aryZ6JfAXBs4qwVjKAgK/8wL4jSBJBMjLKjmIpg==",
                "sha1": "e6b8149fe1206bc421369cb29cdb897907d33be1"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-c/MAL-2026-13872.json"