MalwarePublished 12 Aug 2026

@years18/n8n-nodes-utils-helper-w (npm) · Malicious Code

Affects @years18/n8n-nodes-utils-helper-wSource GCVE Database

Malicious package : remove @years18/n8n-nodes-utils-helper-w and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 17:05 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13867

What to do

Remove @years18/n8n-nodes-utils-helper-w from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years18/n8n-nodes-utils-helper-w	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years18/n8n-nodes-utils-helper-w version 1.0.0 is a malicious package masquerading as a helper for n8n workflows. It contains a hostile payload executed during installation and when required, which collects system information, probes for Python packages, installs additional malicious Python modules, and runs a staged DDoS attack tool. The payload sends collected data to a remote server over HTTPS with disabled TLS verification, indicating an attempt to exfiltrate information. This package abuses its declared purpose as a cover for malicious activity.

Impact

This malicious package compromises the system where it is installed by executing arbitrary commands, modifying the Python environment, and running a denial-of-service attack tool. It also exfiltrates sensitive system information to an attacker-controlled server, potentially enabling further compromise or reconnaissance. The integrity and security of the affected system are severely undermined by this package.

Defensive guidance

The best mitigation is to avoid installing @years18/n8n-nodes-utils-helper-w version 1.0.0. Remove any existing installations of this package immediately and investigate affected systems for signs of compromise. Use trusted sources and verify package authenticity before installation. Monitor for any unauthorized Python package installations or execution of scripts from /tmp.

Summary

The npm package @years18/n8n-nodes-utils-helper-w version 1.0.0 contains malicious code executed both in its postinstall hook and main entry point. The payload runs system commands to gather information (id, hostname), probes for Python packages, installs the 'impacket' Python module forcibly, and executes a staged MHDDoS attack script from /tmp. It exfiltrates collected data by encoding it in base64 and sending it as a URL parameter to a remote server with disabled TLS verification, facilitating data theft. The package's advertised functionality is a decoy to conceal this hostile behavior.

References

npmjs.com/package/@years18/n8n-nodes-utils-helper-w/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 17:05 UTC

Technical details

References

Community reviews