MAL-2026-13916

Dashboard / Malicious Package / MAL-2026-13916

MAL-2026-13916

Summary: Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

Details: Source: amazon-inspector (55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133) On `npm install`, the package's postinstall script (duplicated in the main module) executes shell commands to collect host identity (`id`, `hostname`, `pwd`), locates n8n installation directories, enumerates running n8n processes, and reads n8n-related environment variables. The collected output is base64-encoded and sent via HTTPS GET to the hardcoded endpoint `https://jasabersama.id/portfolio-data.php` with TLS certificate validation disabled (`rejectUnauthorized: false`). The request includes a static key parameter `k=S7k9xQ2mZj` and a `c=` parameter containing a shell command payload (`echo <base64> | base64 -d >> /tmp/n8n_rce_result.txt`), and the endpoint filename plus payload shape indicate an RCE staging harness. The package's advertised utility helper purpose is a cover; the only substantive content is the install-time recon and beacon.

References: https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-g/v/1.0.0