MAL-2026-13873

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-d/MAL-2026-13873.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13873
Published
2026-08-12T12:38:15Z
Modified
2026-08-12T13:00:14Z
Summary
Malicious code in @years17/n8n-nodes-utils-helper-d (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603)

On npm install, the package's postinstall hook runs node callback.js (with identical logic duplicated in index.js so it also fires on require). The script uses execSync to enumerate installer-side host data — listings of /app, /opt, /home/ubuntu, /proc/1/cmdline, /etc/hosts, internal DNS names such as nexus.local/proxy.nexus.local, and the contents of /home/ubuntu/.ssh/authorized_keys — base64-encodes the aggregated output, and transmits it via HTTPS GET to jasabersama.id/portfolio-data.php with rejectUnauthorized: false (TLS verification disabled). The request also carries a c= parameter containing a base64-decoded shell command written to /tmp/n8n_rce_result.txt, consistent with an attacker-side command-delivery handler. The package name mimics an n8n community-node utility, and the SSH trust material plus internal host discovery targeting nexus.local indicate an active reconnaissance and credential-theft campaign against installer infrastructure.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017556",
            "import_time": "2026-08-12T12:51:49.99368714Z",
            "modified_time": "2026-08-12T12:38:15Z",
            "sha256": "cae13b1ae51e25930b719e8953b7349777e5b6c98c514490a937eab4136de603",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years17/n8n-nodes-utils-helper-d

Package

Name
@years17/n8n-nodes-utils-helper-d
View open source insights on deps.dev
Purl
pkg:npm/%40years17/n8n-nodes-utils-helper-d

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "19de5151c66379be521e968f108bb8f5813580578abbbcc642801ce08c504f8b",
            "tlsh": "472163f6337d9830d2f4e097ac4fa485e4abd10718ba79d8e0cc8daa1bc555c56328b5"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-d-1.0.0.tgz",
            "hashes": {
                "sha1": "ca03938a381d437d9250c036cc701b7ad17efc64",
                "sha512_sri": "sha512-3ZPhKcZ2TFmzqvHfKNtANNNIFyuxUa8zuCCHeJYpAP+3m41NQzH0eNE8IU6XCXyqCbK8UntowOzXjctTw16MCQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-d/MAL-2026-13873.json"