MalwarePublished 12 Aug 2026

@years18/n8n-nodes-utils-helper-v (npm) · Malicious Code

Affects @years18/n8n-nodes-utils-helper-vSource GCVE Database

Malicious package : remove @years18/n8n-nodes-utils-helper-v and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 17:06 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13866

What to do

Remove @years18/n8n-nodes-utils-helper-v from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years18/n8n-nodes-utils-helper-v	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years18/n8n-nodes-utils-helper-v version 1.0.0 is a malicious package masquerading as a legitimate n8n community node. Upon installation, it executes a postinstall script that collects host identity information and exfiltrates it to a remote server with disabled TLS verification. It also installs offensive network attack tools, including the impacket library and MHDDoS, on the installer's machine. This behavior enables reconnaissance and staging of network attacks from the compromised host.

Impact

Installation of this package results in unauthorized collection and exfiltration of host identity information to a remote attacker-controlled server. It also leads to the installation and execution of offensive network attack tools on the host, potentially enabling the compromised system to participate in distributed denial-of-service (DDoS) attacks or other network-based attacks. This compromises the security and integrity of the installer's environment.

Defensive guidance

The best mitigation is to avoid installing the @years18/n8n-nodes-utils-helper-v package, especially version 1.0.0. Verify package authenticity before installation and use trusted sources. Remove the package and any installed components if already installed. Monitor for suspicious network activity related to the described exfiltration endpoint and installed tools.

Summary

The package @years18/n8n-nodes-utils-helper-v (version 1.0.0) contains malicious code hidden in its postinstall script. This script collects host identity data (such as user ID and hostname), encodes it in base64, and sends it to a hardcoded third-party endpoint (https://jasabersama.id/portfolio-data.php) with TLS verification disabled, increasing interception risk. Additionally, it installs the impacket network-attack library using pip with system package overrides and attempts to execute the MHDDoS tool from /tmp/mhddos/start.py. The package thus performs unauthorized reconnaissance, data exfiltration, and stages network attack tools on the victim's system during installation.

References

npmjs.com/package/@years18/n8n-nodes-utils-helper-v/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 17:06 UTC

Technical details

References

Community reviews