MAL-2026-13890

Dashboard / Malicious Package / MAL-2026-13890

MAL-2026-13890

Summary: Malicious code in @years19/n8n-nodes-utils-helper-g (npm)

Details: Source: amazon-inspector (9ee748f84613cc36319702d58eb2ce50d87de1a1889a639d2004ddd03226bef7) The package's postinstall script (callback.js) and its declared main entrypoint (index.js) contain byte-identical dropper code that runs on npm install and on require of the module. The code downloads multiple tarballs (mhddos.tgz, pyroxy-full.tgz, impacket.tgz, multidict) from https://jasabersama.id with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp/mhddos and the Python user-site directory, and invokes `python3 start.py` on the extracted payload. The same code collects the output of `id` and `hostname` along with execution results, base64-encodes the buffer, and transmits it via HTTPS GET to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<payload>. The fetched tooling (mhddos, PyRoxy, impacket) is offensive network-attack software staged and launched on the installer's host at install time.

References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-g/v/1.0.0