MAL-2026-13886

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-c/MAL-2026-13886.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13886
Published
2026-08-12T15:10:37Z
Modified
2026-08-12T15:30:12.142401513Z
Summary
Malicious code in @years19/n8n-nodes-utils-helper-c (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e8eda8f141799c4f6f587dbf9771f07e86f64abac9d161319e19b3f836a7fde)

The npm package's postinstall script (callback.js) resolves the user's Python site-packages directory and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over TLS with certificate verification disabled (rejectUnauthorized:false). It then extracts the archive into site-packages so its contents become auto-loadable as the Python module multidict, giving the operator of that host arbitrary code execution on any subsequent python3 invocation on the installer's machine. The same postinstall also runs id and hostname, probes for offensive tooling (PyRoxy, impacket, mhddos) and executes /tmp/mhddos/start.py if present, base64-encodes the collected identity/probe output, and sends it as a GET query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key, also with certificate verification disabled. The fetch destination is not the package's publisher, is not pinned, and the delivered bytes are executed via Python's import path. The package name mimics a legitimate n8n community node.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017601",
            "import_time": "2026-08-12T15:26:13.590658514Z",
            "sha256": "3e8eda8f141799c4f6f587dbf9771f07e86f64abac9d161319e19b3f836a7fde",
            "modified_time": "2026-08-12T15:10:37Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years19/n8n-nodes-utils-helper-c

Package

Name
@years19/n8n-nodes-utils-helper-c
View open source insights on deps.dev
Purl
pkg:npm/%40years19/n8n-nodes-utils-helper-c

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-c/MAL-2026-13886.json"
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "194154f5121192344033b2b46b2bdea6e66bb60754d5bdc8f14c43731f229285e176bc",
            "sha256": "da96b263acf0c54a1c0a7a3529def1779f10a970f6c8eb9a1a4925770066fad2"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-c-1.0.0.tgz",
            "hashes": {
                "sha1": "90369c50180071e334d51a1229ad3298d6bc6125",
                "sha512_sri": "sha512-TqQLmFp9JqEYB9sTPRHd2p5OAHeYFWDmDdyV8jbcax2i79SMLtaTZkInygWcYSwtHaxIpHYcTCjOehLdEdV3vw=="
            }
        }
    ]
}