MAL-2026-13919

    Dashboard / Malicious Package / MAL-2026-13919

    MAL-2026-13919

    Published: 12 Aug 2026Last Modified: 12 Aug 2026

    Summary: Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

    Details: Source: amazon-inspector (ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb) @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script (index.js/callback.js) that executes `id` and `hostname` on the installer host, base64-encodes the output, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The same script writes attacker-controlled content into /tmp/n8n_rce_result.txt and /tmp/filter_pwned.txt, creates /tmp/src-repo, and configures a git `filter.evil.smudge` filter that shells out on checkout, staging follow-on command execution. The package presents itself as an n8n community node (nodes/PwnNode.node.js) but ships no legitimate node functionality; the recon/RCE-staging payload is the entire install-time behavior and fires automatically on `npm install`.

    References: https://www.npmjs.com/package/@years20/n8n-nodes-utils-helper-j/v/1.0.0

    Affected packages

    Package

    Name: @years20/n8n-nodes-utils-helper-j

    Purl: pkg:npm/%40years20/n8n-nodes-utils-helper-j

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-13919 | CVE-DB