MAL-2026-13866

    Dashboard / Malicious Package / MAL-2026-13866

    MAL-2026-13866

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

    Details: Source: amazon-inspector (9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f) The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity (`id`, hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The same postinstall path installs the impacket network-attack library via `pip install --break-system-packages`, probes PyRoxy, and attempts to execute /tmp/mhddos/start.py (MHDDoS). Installing this package auto-runs reconnaissance, exfiltrates installer host identifiers to a hardcoded third-party endpoint, and stages offensive DDoS/network-attack tooling on the installer's machine.

    References: https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-v/v/1.0.0

    Affected packages

    Package

    Name: @years18/n8n-nodes-utils-helper-v

    Purl: pkg:npm/%40years18/n8n-nodes-utils-helper-v

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0