MAL-2026-13909

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-a/MAL-2026-13909.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13909
Published
2026-08-12T15:10:14Z
Modified
2026-08-12T15:30:12Z
Summary
Malicious code in @years20/n8n-nodes-utils-helper-a (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc)

The package's postinstall script (callback.js) and its main module (index.js, byte-identical to callback.js) execute on both npm install and require(). They shell out to collect id, hostname, WSL indicators, and the local SSH host-key fingerprint, base64-encode the recon output, and send it to a hardcoded endpoint at https://jasabersama.id/portfolio-data.php with rejectUnauthorized: false. The payload also decodes an embedded base64 OpenSSH ed25519 private key to /tmp/pk (chmod 600) and iterates common local account names (devuser, ubuntu, runner, node, root, chris, user) attempting SSH into 127.0.0.1:22495 and 127.0.0.1:22, reporting successful logins back to the same external host. The exfil query string carries a URL-encoded shell command that the receiving PHP handler is expected to execute, indicating a server-side command channel. The trigger fires automatically at install time via scripts.postinstall and again whenever a consumer (e.g. n8n loading this custom node) imports the module.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017598",
            "import_time": "2026-08-12T15:26:13.151852404Z",
            "modified_time": "2026-08-12T15:10:14Z",
            "sha256": "53efd1db4158ab9b9fbc01983ff03019e4938eb54329876135b5eb4a0ba927bc",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years20/n8n-nodes-utils-helper-a

Package

Name
@years20/n8n-nodes-utils-helper-a
View open source insights on deps.dev
Purl
pkg:npm/%40years20/n8n-nodes-utils-helper-a

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978",
            "tlsh": "325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"
        },
        {
            "path": "index.js",
            "sha256": "8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978",
            "tlsh": "325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-a-1.0.0.tgz",
            "hashes": {
                "sha1": "b0bcc7f1bfcc7ff0cc5bb1abd35f662630f64754",
                "sha512_sri": "sha512-O+WwRWRCaYi2LM8uABqD8heGHkeCBu5VyYcn6EI85QEZ3Y4k6dbe1TZboleAJz1H7a52+zqz5sk7FIvNkJhigA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-a/MAL-2026-13909.json"