Malicious code in @years18/n8n-nodes-utils-helper-s (npm)
The npm package @years18/n8n-nodes-utils-helper-s version 1.0.0 contains malicious code in its postinstall script. This script downloads two tarballs from an unrelated domain with TLS verification disabled, installs Python dependencies unsafely, and executes a Python script. It also collects system information and sends it encoded to a remote server. The package mimics legitimate n8n community node packages but its functional code is a stub, with the malicious activity occurring during installation.
AI Analysis
Technical Summary
The malicious npm package @years18/n8n-nodes-utils-helper-s version 1.0.0 executes a postinstall lifecycle script that downloads two tarballs (mhddos.tgz and pyroxy.tgz) from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized:false). These tarballs are extracted to /tmp and the Python user site-packages directory. The script then pip-installs a fixed dependency set using the --break-system-packages flag and runs a Python script (start.py) from the extracted mhddos directory. Concurrently, it collects system information (output of 'id' and 'hostname') and installation progress markers, base64-encodes this data, and sends it as a query parameter to a remote URL on jasabersama.id with a fixed key. The package's n8n node file is a non-functional stub, indicating the primary purpose is malicious postinstall execution. The package name is designed to mimic legitimate n8n community node packages, potentially deceiving users.
Potential Impact
The malicious postinstall script can execute arbitrary Python code on the host system, potentially leading to unauthorized system access or compromise. The collection and exfiltration of system information (user and hostname) to a remote server may facilitate further targeted attacks or reconnaissance. The use of TLS with verification disabled increases the risk of man-in-the-middle attacks during payload download. The package's deceptive naming increases the risk of inadvertent installation by users seeking legitimate n8n nodes.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the @years18/n8n-nodes-utils-helper-s package, especially version 1.0.0. Audit existing installations for the presence of this package and remove it if found. Monitor for any unexpected Python processes or network connections to jasabersama.id. Since the package disables TLS verification and downloads malicious payloads during installation, do not trust this package or similarly named packages without verification. Check vendor advisories or trusted sources for updates regarding remediation.
Malicious code in @years18/n8n-nodes-utils-helper-s (npm)
Description
The npm package @years18/n8n-nodes-utils-helper-s version 1.0.0 contains malicious code in its postinstall script. This script downloads two tarballs from an unrelated domain with TLS verification disabled, installs Python dependencies unsafely, and executes a Python script. It also collects system information and sends it encoded to a remote server. The package mimics legitimate n8n community node packages but its functional code is a stub, with the malicious activity occurring during installation.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The malicious npm package @years18/n8n-nodes-utils-helper-s version 1.0.0 executes a postinstall lifecycle script that downloads two tarballs (mhddos.tgz and pyroxy.tgz) from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized:false). These tarballs are extracted to /tmp and the Python user site-packages directory. The script then pip-installs a fixed dependency set using the --break-system-packages flag and runs a Python script (start.py) from the extracted mhddos directory. Concurrently, it collects system information (output of 'id' and 'hostname') and installation progress markers, base64-encodes this data, and sends it as a query parameter to a remote URL on jasabersama.id with a fixed key. The package's n8n node file is a non-functional stub, indicating the primary purpose is malicious postinstall execution. The package name is designed to mimic legitimate n8n community node packages, potentially deceiving users.
Potential Impact
The malicious postinstall script can execute arbitrary Python code on the host system, potentially leading to unauthorized system access or compromise. The collection and exfiltration of system information (user and hostname) to a remote server may facilitate further targeted attacks or reconnaissance. The use of TLS with verification disabled increases the risk of man-in-the-middle attacks during payload download. The package's deceptive naming increases the risk of inadvertent installation by users seeking legitimate n8n nodes.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the @years18/n8n-nodes-utils-helper-s package, especially version 1.0.0. Audit existing installations for the presence of this package and remove it if found. Monitor for any unexpected Python processes or network connections to jasabersama.id. Since the package disables TLS verification and downloads malicious payloads during installation, do not trust this package or similarly named packages without verification. Check vendor advisories or trusted sources for updates regarding remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13863
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b54bf8831d539cde05a
Added to database: 08/12/2026, 16:12:04 UTC
Last enriched: 08/12/2026, 17:05:37 UTC
Last updated: 08/12/2026, 17:05:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.