{"answers":{"affected":"1 open source package ship an affected version, including @years17/n8n-nodes-helper-utils.","exploited":"There is no known exploitation of MAL-2026-13869 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13869 is a malicious package in @years17/n8n-nodes-helper-utils, published on 12 Aug 2026."},"fix_prompt":"MAL-2026-13869 is a malicious package: @years17/n8n-nodes-helper-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13869/ (Markdown: https://insights.sbomify.com/MAL-2026-13869/index.md)","id":"MAL-2026-13869","markdown":"https://insights.sbomify.com/MAL-2026-13869/index.md","name":"MAL-2026-13869","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package ships a malicious n8n community node with three independent installer-harm paths. (1) package.json declares a postinstall script that shells out via `node -e` to run `id` and `hostname` and writes the output to /tmp/pwned.txt at `npm install` time. (2) The package `main` (index.js) executes `id; hostname; uname -a; ls -la /home; cat /etc/hostname` at top-level on require() and writes the collected data to /tmp/n8n_pwned.txt; comments in the file explicitly acknowledge it runs inside n8n's main process with no sandbox, and n8n auto-loads community node packages on startup. (3) The exported HelperUtils node's execute() unconditionally runs `id; hostname; uname -a; ls -la /home; ls -la /` and returns the output as node output labelled `pwned: true`, rather than performing the utility transformation the package name advertises. The three payloads together, along with the self-identifying `pwned` filenames and output flags, are a proof-of-concept malicious n8n node that gains code execution on the installer host at install, on module load, and on workflow execution.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @years17/n8n-nodes-helper-utils (npm)","id":"MAL-2026-13869","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@years17/n8n-nodes-helper-utils","purl":"pkg:npm/%40years17/n8n-nodes-helper-utils","source":"MAL-2026-13869"}],"products":null,"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13869/"}