MAL-2026-13852 Malicious code in @years18/n8n-nodes-utils-helper-f (npm)
Malicious package
Published
MAL-2026-13852 is a malicious package: @years18/n8n-nodes-utils-helper-f (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13852/ (Markdown: https://insights.sbomify.com/MAL-2026-13852/index.md)
- Package
- @years18/n8n-nodes-utils-helper-f
- Registry
- npm
What is MAL-2026-13852?
MAL-2026-13852 is a malicious package in @years18/n8n-nodes-utils-helper-f, published on 12 Aug 2026.
Official description
On npm install, the package's postinstall hook (callback.js / index.js) executes shell commands including
id and hostname, probes the internal RFC1918 address 10.131.106.93:8888 via /dev/tcp, base64-encodes the collected output, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The server-side query is constructed to base64-decode the payload into /tmp/n8n_rce_result.txt. The same postinstall path invokes python3 /tmp/get-pip.py --break-system-packages, pip install -r /tmp/mhddos/requirements.txt, and python3 start.py from /tmp/mhddos, staging and running the mhddos DDoS framework on the installer's machine at install time. The combination yields host reconnaissance exfiltration, internal-network probing, and install-time remote code execution turning the installer into a DDoS node.What should I do about MAL-2026-13852?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.