@years18/n8n-nodes-utils-helper-k (npm) · Malicious Code
Affects @years18/n8n-nodes-utils-helper-kSource GCVE Database
Malicious package : remove @years18/n8n-nodes-utils-helper-k and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 17:03 UTC
Malicious package
Published to npm · OSV MAL-2026-13855
What to do
Remove @years18/n8n-nodes-utils-helper-k from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@years18/n8n-nodes-utils-helper-k | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @years18/n8n-nodes-utils-helper-k version 1.0.0 contains malicious code that executes during installation and import. It downloads and runs a Python-based DDoS toolkit called MHDDoS, disables HTTPS certificate verification during download, and exfiltrates host system information encoded in base64 to a remote server. This compromise occurs regardless of whether npm lifecycle scripts are enabled, affecting all users who install or import the package.