MAL-2026-13858

Dashboard / Malicious Package / MAL-2026-13858

MAL-2026-13858

Summary: Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

Details: Source: amazon-inspector (f747eb82d36d203eb7d0e49df70c41f696f8909284c48a4a8d6a7e785e1b5f98) The package's postinstall script (callback.js) and its declared main (index.js) both fetch two tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ (mhddos.tgz and pyroxy.tgz) over an HTTPS connection with certificate verification disabled (rejectUnauthorized:false), extract mhddos.tgz to /tmp/mhddos and pyroxy.tgz into the installer's Python site-packages, force-install a set of unpinned Python packages using `python3 -m pip install --break-system-packages` (pysocks, cloudscraper, dnspython, psutil, icmplib, pyasn1, yarl, requests_toolbelt, certifi), and then execute `python3 start.py` from the extracted MHDDoS directory. Separately, the same script collects the output of `id` and `hostname`, base64-encodes the result, and issues an HTTPS GET to jasabersama.id/portfolio-data.php with a hardcoded key parameter, providing the operator of that host a per-install beacon carrying installer identity. Because the dropper logic is duplicated in index.js, any consumer that does `require('@years18/n8n-nodes-utils-helper-n')` re-triggers the fetch, extraction, pip install, DDoS launcher, and beacon in addition to the automatic postinstall execution. The advertised package name imitates the n8n community-node namespace; the shipped code has no relation to an n8n node.

References: https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-n/v/1.0.0