MAL-2026-13914

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-f/MAL-2026-13914.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13914
Published
2026-08-12T15:09:54Z
Modified
2026-08-12T15:30:15Z
Summary
Malicious code in @years20/n8n-nodes-utils-helper-f (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7)

The package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callback.js) and on require (identical top-level code in index.js). The payload collects host identity (id, hostname, network interfaces, WSL detection), reads the SSH host public key from /etc/ssh/ssh_host_ed25519_key.pub, and probes internal-network ports including 10.131.106.231:22495. The aggregated data is base64-encoded and sent via https.get to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The package name suggests it is masquerading as an n8n helper node, but the shipped code has no n8n functionality — only the recon/exfil payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017596",
            "import_time": "2026-08-12T15:26:12.996188284Z",
            "modified_time": "2026-08-12T15:09:54Z",
            "sha256": "c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @years20/n8n-nodes-utils-helper-f

Package

Name
@years20/n8n-nodes-utils-helper-f
View open source insights on deps.dev
Purl
pkg:npm/%40years20/n8n-nodes-utils-helper-f

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "sha256": "75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c",
            "tlsh": "783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4"
        },
        {
            "path": "index.js",
            "sha256": "75e648d48dd5e0743b01d22bf5e92b368b61f0afe7cfeeabd5b31159c974410c",
            "tlsh": "783164f9a3a2b1344073b5bce66fd81ad423f507108aedd4b60d82b20f1765c59651f4"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-f-1.0.0.tgz",
            "hashes": {
                "sha1": "ac3995b62ec65d0461f31c7a3a6297a46643050a",
                "sha512_sri": "sha512-PB9MewvGZ5Jru/63IWvn5xdP9eRe1D2L0Kwb914cq0sOi4ZghV7/hBTYWUTf/WvUI8PEKezeSmXja/QJRnWV9w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-f/MAL-2026-13914.json"