MAL-2026-13906

    Dashboard / Malicious Package / MAL-2026-13906

    MAL-2026-13906

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

    Details: Source: amazon-inspector (a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5) The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code that (1) writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP 103.118.252.21 for 900 seconds and launches it via `nohup python3 /tmp/attack2.py... &`, and (2) collects the installer's shell id, hostname, /proc/loadavg and process listing, base64-encodes the blob, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (`rejectUnauthorized: false`). Both triggers fire automatically: the postinstall runs on `npm install`, and the identical main module runs again when n8n loads the community node via `require()`. The package presents itself as an n8n utility helper but ships no functional node code matching that purpose.

    References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-w/v/1.0.0

    Affected packages

    Package

    Name: @years19/n8n-nodes-utils-helper-w

    Purl: pkg:npm/%40years19/n8n-nodes-utils-helper-w

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0