MAL-2026-13898

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-o/MAL-2026-13898.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13898
Published
2026-08-12T15:08:31Z
Modified
2026-08-12T15:30:12Z
Summary
Malicious code in @years19/n8n-nodes-utils-helper-o (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51)

On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes id and hostname, base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017586",
            "import_time": "2026-08-12T15:26:12.113255092Z",
            "modified_time": "2026-08-12T15:08:31Z",
            "sha256": "79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years19/n8n-nodes-utils-helper-o

Package

Name
@years19/n8n-nodes-utils-helper-o
View open source insights on deps.dev
Purl
pkg:npm/%40years19/n8n-nodes-utils-helper-o

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd",
            "tlsh": "1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78"
        },
        {
            "path": "index.js",
            "sha256": "47924dadac91aeda94104bb167a64e883a3a149ca2b795eabef9c6caef32bafd",
            "tlsh": "1b51a6f51521913c003311289f17e879e32fa20798a0fdd9fa8e56725f0161cd64fb78"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-o-1.0.0.tgz",
            "hashes": {
                "sha1": "18bd652bf5cd47bccee4ae06f4ca9b754dab11d0",
                "sha512_sri": "sha512-UViCXAx8wu75SU4VCxZlLY42oMmlyNYQiK6NaxIzwYnGsGnXyqYQNLITDRw4xDhZA83im7hc+xN4JRodOPKrdw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years19/n8n-nodes-utils-helper-o/MAL-2026-13898.json"