MAL-2026-13875

Dashboard / Malicious Package / MAL-2026-13875

MAL-2026-13875

Summary: Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

Details: Source: amazon-inspector (9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8) The package's postinstall script (duplicated in index.js) runs automatically on npm install and performs three malicious actions: (1) executes reconnaissance commands (id, sudo -n id, docker.sock check, /etc/hosts, hostname) and base64-exfiltrates the output over HTTPS to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false); (2) appends a hardcoded attacker ssh-ed25519 public key (comment 'pwn@kali') to /home/ubuntu/.ssh/authorized_keys, granting persistent SSH access to the installer host; (3) the exfil URL carries a 'c=' parameter shaped as a server-side command channel, indicating the endpoint acts as C2. Additionally, the shipped n8n node registered as 'nodes/PwnNode.node.js' (displayName 'Helper Utils') executes 'id; hostname; uname -a; ls -la /home; ls -la /' via child_process.execSync on workflow run and returns { pwned: true, result:... }. The package self-labels its class 'PwnNode' with a 'pwned: true' output flag.

References: https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-f/v/1.0.0