MAL-2026-13918

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-i/MAL-2026-13918.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13918
Published
2026-08-12T15:40:18Z
Modified
2026-08-12T16:03:34.337658336Z
Summary
Malicious code in @years20/n8n-nodes-utils-helper-i (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30)

The package presents itself as an n8n helper node but ships only a stub node (nodes/PwnNode.node.js) and a postinstall script (callback.js, duplicated as index.js) that performs installer-side reconnaissance and exfiltration on npm install. The postinstall shells out to collect user id, hostname, git configuration, running n8n processes, and locations of.n8n directories, base64-encodes the output, and sends it via HTTPS GET to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same postinstall performs an unpinned git clone of a personal GitHub repository (github.com/yadhukrishnam/CVE-2026-25053) into /tmp/gh-test during install, fetching third-party content unrelated to the package publisher on mutable HEAD. The referenced repository name embeds a CVE identifier consistent with an n8n supply-chain proof-of-concept payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017612",
            "import_time": "2026-08-12T15:53:00.808321345Z",
            "sha256": "a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T15:40:18Z"
        }
    ]
}
References
Credits

Affected packages

npm / @years20/n8n-nodes-utils-helper-i

Package

Name
@years20/n8n-nodes-utils-helper-i
View open source insights on deps.dev
Purl
pkg:npm/%40years20/n8n-nodes-utils-helper-i

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "callback.js",
            "tlsh": "4a2161f95210e5705463b0a06e7fff46e8afba0704cdeec8f14d06730b228a82b4656c",
            "sha256": "6f7d31df79c97297540362b4ba5d81ae984d96cf4f653b328dd78569089b8151"
        },
        {
            "path": "package.json",
            "tlsh": "7ff0a3028c720f3311cd6b6b18994141aa246e97949c7c2c73cf010c87dc6f519bd58d",
            "sha256": "1c1f0a5b893b29e637acab981cede40c9ff48bd6803e6fd0f26ef52f90528c46"
        }
    ],
    "package_integrity": [
        {
            "filename": "n8n-nodes-utils-helper-i-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-SqFQFtPll0FI0ASq/7PWY6DELJXa7/OLvzmxDqvIUiAPSCZiBqEy6SxYNW9oNA2Re/+PEBwZ1X3l8Rmf6hrZKg==",
                "sha1": "15b0ad35aeffc19aefa0bc3051aa96a945e63645"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@years20/n8n-nodes-utils-helper-i/MAL-2026-13918.json"