MalwarePublished 12 Aug 2026

@years17/n8n-nodes-utils-helper (npm) · Malicious Code

Affects @years17/n8n-nodes-utils-helperSource GCVE Database

Malicious package : remove @years17/n8n-nodes-utils-helper and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13870

What to do

Remove @years17/n8n-nodes-utils-helper from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years17/n8n-nodes-utils-helper	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years17/n8n-nodes-utils-helper versions 1.0.0 and 1.0.1 contains malicious code that performs host reconnaissance and secret harvesting. Its postinstall script and runtime code execute system commands to gather sensitive host information and environment variables, then exfiltrate this data to a remote server with disabled TLS certificate validation. Additionally, it includes a node that allows execution of reconnaissance commands within n8n workflows, exposing a host compromise vector.

Impact

This malicious package can lead to unauthorized disclosure of sensitive host information, environment secrets, SSH keys, and system details. The exfiltration of this data to an attacker-controlled server compromises confidentiality and may facilitate further attacks on the affected system or network. The embedded node enables operators to execute arbitrary reconnaissance commands within n8n workflows, increasing the attack surface and potential for exploitation.

Defensive guidance

Users should immediately remove the @years17/n8n-nodes-utils-helper package versions 1.0.0 and 1.0.1 from their environments. Avoid installing or using this package. Review systems for signs of compromise and unauthorized data exfiltration. Monitor for suspicious network connections to jasabersama.id or similar domains. Consider replacing this package with trusted alternatives.

Summary

The @years17/n8n-nodes-utils-helper package (versions 1.0.0 and 1.0.1) is malicious. Its postinstall script and index.js execute commands such as id, hostname, uname -a, and checks for docker sockets and sudo privileges. It collects directory listings and SSH authorized keys, filters environment variables for secrets, base64-encodes this data, and sends it to https://jasabersama.id/portfolio-data.php with TLS certificate validation disabled (rejectUnauthorized: false). The package also bundles a PwnNode that exposes an execute() method to run reconnaissance commands via child_process.execSync, returning the output to the operator. The package masquerades as a utility helper but solely performs host reconnaissance, secret harvesting, and data exfiltration.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:54 UTC

Technical details

References

Community reviews