Malicious code in @years18/n8n-nodes-utils-helper-n (npm)
The npm package '@years18/n8n-nodes-utils-helper-n' version 1.0.0 contains malicious code that executes during installation and runtime. It downloads and extracts two tarballs from an untrusted source with disabled HTTPS certificate verification, installs unpinned Python packages with elevated permissions, and runs a DDoS attack script. Additionally, it collects system identity information and sends it to a remote server, effectively beaconing the compromised host. The package name mimics a legitimate n8n community node namespace but is unrelated to n8n functionality.
AI Analysis
Technical Summary
The malicious npm package '@years18/n8n-nodes-utils-helper-n' version 1.0.0 includes a postinstall script and main module that fetch two tarballs (mhddos.tgz and pyroxy.tgz) from 'https://jasabersama.id/assets/cache/.theme-backup/dl/' with HTTPS certificate verification disabled. It extracts these tarballs to system directories, forcibly installs multiple unpinned Python packages using 'python3 -m pip install --break-system-packages', and executes a Python script (start.py) that launches a DDoS attack tool (MHDDoS). The script also collects and base64-encodes the output of 'id' and 'hostname' commands, sending this data as a beacon to a remote server with a hardcoded key. The malicious behavior is triggered both during installation and whenever the package is required, causing repeated execution of the payload. The package name is deceptive, imitating the n8n community-node namespace but containing no legitimate n8n node code.
Potential Impact
Systems that install or require '@years18/n8n-nodes-utils-helper-n' version 1.0.0 are compromised by execution of malicious code that installs additional Python packages, launches a DDoS attack tool, and leaks system identity information to a remote attacker. This can lead to unauthorized use of system resources for DDoS attacks and exposure of host identity information. The forced installation of unpinned Python packages with system package breakage risks further system instability or compromise.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall '@years18/n8n-nodes-utils-helper-n' version 1.0.0 if installed and avoid installing packages from untrusted or suspicious sources. Review and remove any installed Python packages forcibly installed by the malicious script. Monitor for unusual network traffic indicative of DDoS activity or beaconing to 'jasabersama.id'. Consider blocking network access to the indicated domain at the firewall level. Check the vendor advisory or trusted security sources for updates on remediation status.
Malicious code in @years18/n8n-nodes-utils-helper-n (npm)
Description
The npm package '@years18/n8n-nodes-utils-helper-n' version 1.0.0 contains malicious code that executes during installation and runtime. It downloads and extracts two tarballs from an untrusted source with disabled HTTPS certificate verification, installs unpinned Python packages with elevated permissions, and runs a DDoS attack script. Additionally, it collects system identity information and sends it to a remote server, effectively beaconing the compromised host. The package name mimics a legitimate n8n community node namespace but is unrelated to n8n functionality.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious npm package '@years18/n8n-nodes-utils-helper-n' version 1.0.0 includes a postinstall script and main module that fetch two tarballs (mhddos.tgz and pyroxy.tgz) from 'https://jasabersama.id/assets/cache/.theme-backup/dl/' with HTTPS certificate verification disabled. It extracts these tarballs to system directories, forcibly installs multiple unpinned Python packages using 'python3 -m pip install --break-system-packages', and executes a Python script (start.py) that launches a DDoS attack tool (MHDDoS). The script also collects and base64-encodes the output of 'id' and 'hostname' commands, sending this data as a beacon to a remote server with a hardcoded key. The malicious behavior is triggered both during installation and whenever the package is required, causing repeated execution of the payload. The package name is deceptive, imitating the n8n community-node namespace but containing no legitimate n8n node code.
Potential Impact
Systems that install or require '@years18/n8n-nodes-utils-helper-n' version 1.0.0 are compromised by execution of malicious code that installs additional Python packages, launches a DDoS attack tool, and leaks system identity information to a remote attacker. This can lead to unauthorized use of system resources for DDoS attacks and exposure of host identity information. The forced installation of unpinned Python packages with system package breakage risks further system instability or compromise.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall '@years18/n8n-nodes-utils-helper-n' version 1.0.0 if installed and avoid installing packages from untrusted or suspicious sources. Review and remove any installed Python packages forcibly installed by the malicious script. Monitor for unusual network traffic indicative of DDoS activity or beaconing to 'jasabersama.id'. Consider blocking network access to the indicated domain at the firewall level. Check the vendor advisory or trusted security sources for updates on remediation status.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13858
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b54bf8831d539cde048
Added to database: 08/12/2026, 16:12:04 UTC
Last enriched: 08/12/2026, 17:04:20 UTC
Last updated: 08/12/2026, 17:04:20 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.