MAL-2026-13887

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-d/MAL-2026-13887.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13887
Published
2026-08-12T15:10:45Z
Modified
2026-08-12T15:30:14Z
Summary
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7)

The package presents itself as an n8n community node (n8n-nodes-utils-helper-d) but its actual on-install behavior is unrelated to workflow automation. The postinstall script fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over an HTTPS connection with TLS certificate validation disabled (rejectUnauthorized:false) and extracts it into the user's Python site-packages, shadowing the real multidict module so subsequent import multidict in the environment executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and /tmp/mhddos/start.py, consistent with a DDoS / offensive-tooling dropper. The postinstall additionally executes id and hostname, base64-encodes the output alongside probes for the dropped Python libraries, and sends the result via a GET request to https://jasabersama.id/portfolio-data.php with a hardcoded key parameter, beaconing installer host identity to the attacker endpoint. The shipped node file is a stub named PwnNode.node.js, and no legitimate n8n node functionality is present.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017602",
            "import_time": "2026-08-12T15:26:13.683532197Z",
            "modified_time": "2026-08-12T15:10:45Z",
            "sha256": "72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years19/n8n-nodes-utils-helper-d

Package

Name
@years19/n8n-nodes-utils-helper-d
View open source insights on deps.dev
Purl
pkg:npm/%40years19/n8n-nodes-utils-helper-d

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "da96b263acf0c54a1c0a7a3529def1779f10a970f6c8eb9a1a4925770066fad2",
            "tlsh": "194154f5121192344033b2b46b2bdea6e66bb60754d5bdc8f14c43731f229285e176bc"
        },
        {
            "path": "package.json",
            "sha256": "80a9429c4df8ec0d8e05b2d20109441985d3d3971aac9cdb545ea5a5b209927e",
            "tlsh": "21f0ab038c720f3321cdab66189a8101ab246e8b949c7c2c73cf010c87dc7f52abe68d"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-d-1.0.0.tgz",
            "hashes": {
                "sha1": "3f008ce704cd7c4396ee4250bd237da3a82eb4e5",
                "sha512_sri": "sha512-eXsPN7FjzOfWMHJh2SkVOo/Jh4aFyk9Ia4q2jr+VDuokIxv3bJgt7TM8eo9G+spuASq0hbkRiUlblSxUHxivFQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-d/MAL-2026-13887.json"