MAL-2026-13907

Dashboard / Malicious Package / MAL-2026-13907

MAL-2026-13907

Summary: Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

Details: Source: amazon-inspector (da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4) The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via `nohup python3 /tmp/attack2.py &`, weaponizing the installer's host and IP as a DDoS bot. In parallel, it collects the output of `id`, `hostname`, a process check and /proc/loadavg, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The package is presented as an n8n utility helper but ships no such functionality; its only observable behavior is the DDoS launcher and host-identity beacon.

References: https://www.npmjs.com/package/@years19/n8n-nodes-utils-helper-x/v/1.0.0