MAL-2026-13918

    Dashboard / Malicious Package / MAL-2026-13918

    MAL-2026-13918

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

    Details: Source: amazon-inspector (a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30) The package presents itself as an n8n helper node but ships only a stub node (nodes/PwnNode.node.js) and a postinstall script (callback.js, duplicated as index.js) that performs installer-side reconnaissance and exfiltration on npm install. The postinstall shells out to collect user id, hostname, git configuration, running n8n processes, and locations of.n8n directories, base64-encodes the output, and sends it via HTTPS GET to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same postinstall performs an unpinned git clone of a personal GitHub repository (github.com/yadhukrishnam/CVE-2026-25053) into /tmp/gh-test during install, fetching third-party content unrelated to the package publisher on mutable HEAD. The referenced repository name embeds a CVE identifier consistent with an n8n supply-chain proof-of-concept payload.

    References: https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-i/v/1.0.0

    Affected packages

    Package

    Name: @years20/n8n-nodes-utils-helper-i

    Purl: pkg:npm/%40years20/n8n-nodes-utils-helper-i

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0