MAL-2026-13885
Dashboard / Malicious Package / MAL-2026-13885
MAL-2026-13885
Summary: Malicious code in @years19/n8n-nodes-utils-helper-b (npm)
Details: Source: amazon-inspector (a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf) Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js) is a 213-byte stub with no functionality. The postinstall hook — duplicated in the main index.js — shells out to collect the output of `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), and extracts the tarball into the user's Python site-packages directory, giving whoever controls the tarball code execution on any subsequent Python import. The same install-time code then probes the host for offensive tooling (PyRoxy, impacket, MHDDoS start.py), base64-encodes the recon output together with the id/hostname/site-path values, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php. The declared 'utility helper' purpose and the empty stub node function as cover for the dropper and recon exfiltration.
Affected packages
Package
Name: @years19/n8n-nodes-utils-helper-b
Purl: pkg:npm/%40years19/n8n-nodes-utils-helper-b
Affected ranges
Type: N/A
Events:
