MAL-2026-13867
Dashboard / Malicious Package / MAL-2026-13867
MAL-2026-13867
Summary: Malicious code in @years18/n8n-nodes-utils-helper-w (npm)
Details: Source: amazon-inspector (5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab) This package presents itself as an n8n workflow helper but ships a near-empty node stub (nodes/PwnNode.node.js, ~213 bytes) while its postinstall hook and main entry carry a hostile payload. package.json declares postinstall: node callback.js, and index.js is a byte-identical copy of callback.js, so both `npm install` and `require()` execute the same code. The payload runs `id` and `hostname`, probes for Python packages, executes a staged tool at /tmp/mhddos/start.py (the MHDDoS attack toolkit), base64-encodes the aggregated output, and sends it as a URL query parameter to https://jasabersama.id/portfolio-data.php over HTTPS with TLS verification disabled (rejectUnauthorized:false). It also runs `python3 -m pip install --quiet --break-system-packages impacket`, mutating the installer's system Python environment, and executes attacker-staged code from /tmp. The mismatch between the advertised n8n-helper purpose and the shipped functionality — plus duplication of the payload across both auto-executed surfaces — indicates the declared purpose is a cover for the attack.
Affected packages
Package
Name: @years18/n8n-nodes-utils-helper-w
Purl: pkg:npm/%40years18/n8n-nodes-utils-helper-w
Affected ranges
Type: N/A
Events:
