MAL-2026-13854

Dashboard / Malicious Package / MAL-2026-13854

MAL-2026-13854

Summary: Malicious code in @years18/n8n-nodes-utils-helper-j (npm)

Details: Source: amazon-inspector (c17b5de9890a54a8a7a1ddf14ff05488baa64612904cf577591e1b9f9a007f1a) The package ships a postinstall hook (`node callback.js`) and a main entrypoint (`index.js`, byte-identical to callback.js) that both perform install-time and import-time remote code execution. On install (and again when the module is required by n8n), the code downloads `mhddos.tgz` and `get-pip.py` from https://jasabersama.id/assets/cache/.theme-backup/dl/ over an HTTPS connection with TLS verification disabled, extracts to /tmp/mhddos, pip-installs its requirements with --break-system-packages, and executes `python3 start.py` — the MHDDoS DDoS tool. Before the drop, callback.js/index.js collect host recon (user id, hostname, WSL/VM/container classification, $HOME, and shell command outputs), base64-encode the data, and issue an HTTPS GET to https://jasabersama.id/portfolio-data.php with the recon in the `c` query parameter. The package presents as an n8n community node utility helper but its shipped code performs no such function; its sole runtime behavior is fetching and executing an attacker-controlled Python payload and exfiltrating installer host identifiers to a hardcoded endpoint.

References: https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-j/v/1.0.0