MAL-2026-13859

    Dashboard / Malicious Package / MAL-2026-13859

    MAL-2026-13859

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

    Details: Source: amazon-inspector (5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4) The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of Python DDoS-support dependencies via pip with --break-system-packages, then executes `python3 start.py` from the extracted MHDDoS archive. The same script runs `id` and `hostname`, base64-encodes the output along with install-progress markers, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. The declared n8n utility purpose is a cover story for the install-time payload.

    References: https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-o/v/1.0.0

    Affected packages

    Package

    Name: @years18/n8n-nodes-utils-helper-o

    Purl: pkg:npm/%40years18/n8n-nodes-utils-helper-o

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13859 | CVE-DB