MAL-2026-13896

    Dashboard / Malicious Package / MAL-2026-13896

    MAL-2026-13896

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years19/n8n-nodes-utils-helper-m (npm)

    Details: Source: amazon-inspector (85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268) On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches three long-running python3 processes that direct traffic at a hardcoded target IP, turning the installer's host into a DDoS bot. The same script runs `id` and `hostname`, base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, with the URL also carrying a `c=` parameter shell-composed to write attacker-supplied base64 content into /tmp/n8n_rce_result.txt. The package name suggests an n8n-nodes utility but the shipped code contains no such functionality.

    References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-m/v/1.0.0

    Affected packages

    Package

    Name: @years19/n8n-nodes-utils-helper-m

    Purl: pkg:npm/%40years19/n8n-nodes-utils-helper-m

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13896 | CVE-DB