MAL-2026-13900

Dashboard / Malicious Package / MAL-2026-13900

MAL-2026-13900

Summary: Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

Details: Source: amazon-inspector (ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a) Package @years19/[email protected] ships two byte-identical top-level scripts (callback.js and index.js). package.json declares "main":"index.js" and "postinstall":"node callback.js", so the same payload fires both on npm install and on any require()/import of the package. On execution the scripts download multiple tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extract them under /tmp, and spawn python3 start.py in the background to launch UDP/TCP/GET flood traffic against 103.118.252.21 — turning the installer's machine into a DDoS attack node. Separately, the scripts run `id` and `hostname`, base64-encode the output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating installer host identity to a hardcoded attacker-controlled endpoint. Multiple auto-execution paths, TLS validation disabled, and an unrelated non-publisher host delivering opaque archives that are then executed match a canonical install-time RCE / dropper with concurrent host abuse and exfiltration.

References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-q/v/1.0.0