MAL-2026-13912

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-d/MAL-2026-13912.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13912
Published
2026-08-12T15:07:33Z
Modified
2026-08-12T15:30:14Z
Summary
Malicious code in @years20/n8n-nodes-utils-helper-d (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8)

The package runs a hostile payload both from its declared postinstall hook (node callback.js) and at library load via index.js, which is byte-identical to callback.js and set as main. The payload runs id, collects the machine hostname, detects WSL, and reads /etc/ssh/ssh_host_ed25519_key.pub, then base64-encodes the data and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The exfil query wraps the encoded data in a shell command framed as portfolio-data.php. The same script decodes a base64-embedded OpenSSH ed25519 private key to /tmp/pk, chmods it to 600, and attempts SSH logins to 127.0.0.1:22495 and 127.0.0.1:22 as users devuser, ubuntu, runner, node, root, chris, and user, reporting successful authentications back to jasabersama.id. Because the payload is duplicated at module load, it also fires when n8n or any consumer performs require('@years20/n8n-nodes-utils-helper-d'), bypassing --ignore-scripts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017579",
            "import_time": "2026-08-12T15:26:11.522234117Z",
            "modified_time": "2026-08-12T15:07:33Z",
            "sha256": "84dc74cbe8090f7fd99c65cda379129055830b63fafb28c8364f3e28de5bbbb8",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years20/n8n-nodes-utils-helper-d

Package

Name
@years20/n8n-nodes-utils-helper-d
View open source insights on deps.dev
Purl
pkg:npm/%40years20/n8n-nodes-utils-helper-d

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978",
            "tlsh": "325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"
        },
        {
            "path": "index.js",
            "sha256": "8176be617df1750652d87e367cc3b6d871fbef43b371472f7976369db53db978",
            "tlsh": "325198f851a0a53422b360b75dbadc15d5bffa02518addc8714d0b335fd6c9809336b8"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-d-1.0.0.tgz",
            "hashes": {
                "sha1": "ff40826df9b2b852044091f2bdace9dc2ffa0de3",
                "sha512_sri": "sha512-7utzYxoBuzRXhD5u0VjB19K/jEVqxM3+a/YFRrn88iadbfbUpHttJiToxT5uDnLM1fE/lt1CGGxCiMBnucEyqw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-d/MAL-2026-13912.json"