MAL-2026-13875

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-f/MAL-2026-13875.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13875
Published
2026-08-12T12:37:29Z
Modified
2026-08-12T13:00:14.537256664Z
Summary
Malicious code in @years17/n8n-nodes-utils-helper-f (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8)

The package's postinstall script (duplicated in index.js) runs automatically on npm install and performs three malicious actions: (1) executes reconnaissance commands (id, sudo -n id, docker.sock check, /etc/hosts, hostname) and base64-exfiltrates the output over HTTPS to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false); (2) appends a hardcoded attacker ssh-ed25519 public key (comment 'pwn@kali') to /home/ubuntu/.ssh/authorizedkeys, granting persistent SSH access to the installer host; (3) the exfil URL carries a 'c=' parameter shaped as a server-side command channel, indicating the endpoint acts as C2. Additionally, the shipped n8n node registered as 'nodes/PwnNode.node.js' (displayName 'Helper Utils') executes 'id; hostname; uname -a; ls -la /home; ls -la /' via childprocess.execSync on workflow run and returns { pwned: true, result:... }. The package self-labels its class 'PwnNode' with a 'pwned: true' output flag.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017550",
            "import_time": "2026-08-12T12:51:49.63102081Z",
            "sha256": "9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T12:37:29Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years17/n8n-nodes-utils-helper-f

Package

Name
@years17/n8n-nodes-utils-helper-f
View open source insights on deps.dev
Purl
pkg:npm/%40years17/n8n-nodes-utils-helper-f

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "2f2146f532785d708bf4c5931d5f95b6f49b910316b278c4e0cc48a52bc799846329bd",
            "sha256": "2adf8b78ec9205232c34c87fb59a5850f107f06a448df2b105b4a74a8ef9ae3f"
        },
        {
            "path": "nodes/PwnNode.node.js",
            "tlsh": "fe111ef7adb6e2600092b4d75b07a1022822c3172725bc79ba8c46534f4894ca7b1ef8",
            "sha256": "b4b05aecc01697e3bb67ad3be71d575674cc2ee0cbd81e01985289242f4d4059"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-f-1.0.0.tgz",
            "hashes": {
                "sha1": "c6a5238f8f9171d9b69d1e7198f73354ff02d01d",
                "sha512_sri": "sha512-nZJyxNYxfSQ+smR0AUsiufkjPRr7v6mmL8H1jycAcj1CTAJUSRreUcFHRGFov5cS9C/1LjMI3p6qd3djBJBBAA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years17/n8n-nodes-utils-helper-f/MAL-2026-13875.json"