MAL-2026-13902

Dashboard / Malicious Package / MAL-2026-13902

MAL-2026-13902

Summary: Malicious code in @years19/n8n-nodes-utils-helper-s (npm)

Details: Source: amazon-inspector (2955ed4843fe66495bbe53420b28e91530f48facae3aea0a9c3719676c30c0a5) The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds — and launches it in the background via nohup python3. The same code path is present in index.js, which is declared as the package `main`, so require()ing the module re-triggers the dropper even when installation runs with --ignore-scripts. Both files also collect installer host identity (`id`, `hostname`, process listing, /proc/loadavg), base64-encode the data, and send it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The package presents itself as an n8n utility node but contains no such functionality; its only behavior is host reconnaissance exfiltration and using the installer's machine as a DDoS bot against a third-party target.

References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-s/v/1.0.0