MAL-2026-13905

    Dashboard / Malicious Package / MAL-2026-13905

    MAL-2026-13905

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

    Details: Source: amazon-inspector (f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282) The package's postinstall hook runs `node callback.js`, and package.json declares `main: index.js` with byte-identical contents, so the payload fires on both `npm install` and `require()`/import. On execution the code writes a Python UDP/TCP flood script to /tmp/attack.py and launches it via `nohup python3 /tmp/attack.py &`, directing ~650 threads at 103.118.252.21 on ports 80/443 for 600 seconds. In parallel, the code runs `id` and `hostname`, collects process/loadavg indicators, base64-encodes the result, and sends it via `https.get` with `rejectUnauthorized: false` to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<encoded>`. Installer hosts become participants in an outbound DDoS attack while also leaking host identity to a hardcoded endpoint.

    References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-v/v/1.0.0

    Affected packages

    Package

    Name: @years19/n8n-nodes-utils-helper-v

    Purl: pkg:npm/%40years19/n8n-nodes-utils-helper-v

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13905 | CVE-DB