MAL-2026-13893

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-j/MAL-2026-13893.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13893
Published
2026-08-12T15:09:37Z
Modified
2026-08-12T15:30:14.336536990Z
Summary
Malicious code in @years19/n8n-nodes-utils-helper-j (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571)

package.json postinstall runs callback.js, and index.js (declared main) is byte-identical, so both npm install and any require() of the package trigger the same payload. The code fetches multiple tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id over TLS with certificate verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's site-packages, and spawns python3 processes that flood a hardcoded target at 103.118.252.21 with UDP/TCP/HTTP traffic. In parallel, callback.js collects the output of id and hostname, dependency status, and attack log tails, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php; the c parameter is also shaped as a shell command for the receiving endpoint. Disabling TLS verification and pinning nothing makes the transport resilient to substitution of the attacker host's certificate. Installing or importing this package turns the host into a DDoS bot under the installer's user account and leaks host identity to the attacker endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017594",
            "import_time": "2026-08-12T15:26:12.843455933Z",
            "sha256": "4f2e508e05396394d7bf5e459b0fd0e97016592cb83e28dbeac9a678a1a53571",
            "modified_time": "2026-08-12T15:09:37Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years19/n8n-nodes-utils-helper-j

Package

Name
@years19/n8n-nodes-utils-helper-j
View open source insights on deps.dev
Purl
pkg:npm/%40years19/n8n-nodes-utils-helper-j

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78",
            "sha256": "47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd"
        },
        {
            "path": "index.js",
            "tlsh": "1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78",
            "sha256": "47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-j-1.0.0.tgz",
            "hashes": {
                "sha1": "8775102db555a1b938c6a82aa914907a64ddd966",
                "sha512_sri": "sha512-KlM1dUIKN+b6/Esr8In97jZAIWecPBPSqVT6KWQXmuu/6Sokv61kJzK/TG9h1AOWQnFkn6nOssnuZoXhjQur9Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-j/MAL-2026-13893.json"