MalwarePublished 12 Aug 2026

@years18/n8n-nodes-utils-helper-l (npm) · Malicious Code

Affects @years18/n8n-nodes-utils-helper-lSource GCVE Database

Malicious package : remove @years18/n8n-nodes-utils-helper-l and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 17:03 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13856

What to do

Remove @years18/n8n-nodes-utils-helper-l from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years18/n8n-nodes-utils-helper-l	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years18/n8n-nodes-utils-helper-l version 1.0.0 contains malicious code that executes on installation and when required. It downloads and runs a Python-based DDoS toolkit from an untrusted external source with TLS validation disabled, collects host system information, and exfiltrates it to a remote server. This behavior occurs automatically due to the package's main module loading on require, including when used by the n8n runtime for community nodes.

Impact

This malicious package can lead to unauthorized execution of a DDoS toolkit on the host system, potentially participating in distributed denial-of-service attacks. It also exfiltrates sensitive host information such as system identifiers and environment details to an attacker-controlled server. The automatic execution on require() increases the risk of unnoticed compromise in environments using this package, including n8n runtime community nodes.

Defensive guidance

Users should immediately remove the @years18/n8n-nodes-utils-helper-l package version 1.0.0 from their environments and avoid installing or requiring it. Verify dependencies and audit installed packages for this malicious code. Monitor for any unauthorized network connections to jasabersama.id domains and investigate any suspicious Python processes. Consider restricting or blocking network access to the indicated domains at the network perimeter.

Summary

The @years18/n8n-nodes-utils-helper-l npm package version 1.0.0 includes a postinstall script and main module that act as byte-identical droppers. Upon installation and module load, they fetch a tarball and Python script from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz and get-pip.py over HTTPS with certificate validation explicitly disabled. The payload is extracted to /tmp/mhddos, Python dependencies are installed with pip using --break-system-packages, and a Python script (start.py) is executed. This script is an mhddos DDoS toolkit. The dropper also collects host identifiers including system and environment details, encodes them in base64, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key. Because the package.json declares index.js as main, this malicious code executes on any require() of the package, including automatic loading by the n8n runtime. The fetched payload is unpinned, unverified, and retrieved from a host unrelated to the package publisher, with TLS validation disabled, increasing risk.

References

npmjs.com/package/@years18/n8n-nodes-utils-helper-l/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 17:03 UTC

Technical details

References

Community reviews