MAL-2026-13850

Dashboard / Malicious Package / MAL-2026-13850

MAL-2026-13850

Summary: Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

Details: Source: amazon-inspector (0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e) Package is presented as an n8n community node but the only node file (nodes/PwnNode.node.js) is a 213-byte stub; the real behavior is in callback.js, which is invoked by the postinstall lifecycle hook ("postinstall": "node callback.js"). On install, callback.js performs three attacker-benefit actions against the installer's host: (1) it fetches https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over TLS with certificate validation disabled (rejectUnauthorized: false), writes it to /tmp/mhddos.tgz, extracts it, pip-installs its declared requirements, and runs python3 start.py — unattended remote code execution of a mutable third-party archive labelled after the mhddos DDoS tool family; (2) it runs `id` and `hostname` and probes an internal TCP endpoint, base64-encodes the combined output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, leaking installer identity and network state to the same author-controlled host; (3) it executes `bash -c 'echo > /dev/tcp/10.131.106.93/8888'` against a hardcoded RFC1918 address (with a source comment referring to Sliver, an offensive C2 framework) and reports reachability back — internal-network reconnaissance consistent with lateral-movement staging. index.js contains the same payload as callback.js, ensuring the code also runs on require of the module.

References: https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-d/v/1.0.0