MAL-2026-13914

    Dashboard / Malicious Package / MAL-2026-13914

    MAL-2026-13914

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years20/n8n-nodes-utils-helper-f (npm)

    Details: Source: amazon-inspector (c8297c0d5a6f2c446285924983ee24b195c180fbaa75a7826e8e925497eddab7) The package auto-executes a reconnaissance and exfiltration payload both at install (via scripts.postinstall running callback.js) and on require (identical top-level code in index.js). The payload collects host identity (id, hostname, network interfaces, WSL detection), reads the SSH host public key from /etc/ssh/ssh_host_ed25519_key.pub, and probes internal-network ports including 10.131.106.231:22495. The aggregated data is base64-encoded and sent via https.get to https://jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). The package name suggests it is masquerading as an n8n helper node, but the shipped code has no n8n functionality — only the recon/exfil payload.

    References: https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-f/v/1.0.0

    Affected packages

    Package

    Name: @years20/n8n-nodes-utils-helper-f

    Purl: pkg:npm/%40years20/n8n-nodes-utils-helper-f

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13914 | CVE-DB