MAL-2026-13878

    Dashboard / Malicious Package / MAL-2026-13878

    MAL-2026-13878

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years17/n8n-nodes-utils-helper-i (npm)

    Details: Source: amazon-inspector (53f34d42e090332e45832b4ab41bb9f5d6fce3ae52309e537a2b884845f2bdd5) The package's postinstall hook runs callback.js, which appends a hardcoded attacker ssh-ed25519 public key (tagged pwn@kali) to authorized_keys for root, ubuntu, node, runner, and devuser, granting persistent SSH access to the installer's host. It then base64-encodes host reconnaissance (id, hostname, sudo -n id output, /home listing, docker.sock presence) and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. index.js — the package main entry — contains byte-identical code, so the same implant and exfiltration fire on require('@years17/n8n-nodes-utils-helper-i'), providing a second trigger even when --ignore-scripts is used.

    References: https://www.npmjs.com/package/@years17/n8n-nodes-utils-helper-i/v/1.0.0

    Affected packages

    Package

    Name: @years17/n8n-nodes-utils-helper-i

    Purl: pkg:npm/%40years17/n8n-nodes-utils-helper-i

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13878 | CVE-DB