MAL-2026-13898
Dashboard / Malicious Package / MAL-2026-13898
MAL-2026-13898
Summary: Malicious code in @years19/n8n-nodes-utils-helper-o (npm)
Details: Source: amazon-inspector (79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51) On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes `id` and `hostname`, base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.
Affected packages
Package
Name: @years19/n8n-nodes-utils-helper-o
Purl: pkg:npm/%40years19/n8n-nodes-utils-helper-o
Affected ranges
Type: N/A
Events:
