{"answers":{"affected":"1 open source package ship an affected version, including @years19/n8n-nodes-utils-helper-c.","exploited":"There is no known exploitation of MAL-2026-13886 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13886 is a malicious package in @years19/n8n-nodes-utils-helper-c, published on 12 Aug 2026."},"fix_prompt":"MAL-2026-13886 is a malicious package: @years19/n8n-nodes-utils-helper-c (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13886/ (Markdown: https://insights.sbomify.com/MAL-2026-13886/index.md)","id":"MAL-2026-13886","markdown":"https://insights.sbomify.com/MAL-2026-13886/index.md","name":"MAL-2026-13886","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The npm package's postinstall script (callback.js) resolves the user's Python site-packages directory and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over TLS with certificate verification disabled (rejectUnauthorized:false). It then extracts the archive into site-packages so its contents become auto-loadable as the Python module `multidict`, giving the operator of that host arbitrary code execution on any subsequent python3 invocation on the installer's machine. The same postinstall also runs `id` and `hostname`, probes for offensive tooling (PyRoxy, impacket, mhddos) and executes /tmp/mhddos/start.py if present, base64-encodes the collected identity/probe output, and sends it as a GET query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key, also with certificate verification disabled. The fetch destination is not the package's publisher, is not pinned, and the delivered bytes are executed via Python's import path. The package name mimics a legitimate n8n community node.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @years19/n8n-nodes-utils-helper-c (npm)","id":"MAL-2026-13886","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@years19/n8n-nodes-utils-helper-c","purl":"pkg:npm/%40years19/n8n-nodes-utils-helper-c","source":"MAL-2026-13886"}],"products":null,"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13886/"}