MalwarePublished 12 Aug 2026

@years19/n8n-nodes-utils-helper-b (npm) · Malicious Code

Affects @years19/n8n-nodes-utils-helper-bSource GCVE Database

Malicious package : remove @years19/n8n-nodes-utils-helper-b and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13885

What to do

Remove @years19/n8n-nodes-utils-helper-b from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years19/n8n-nodes-utils-helper-b	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years19/n8n-nodes-utils-helper-b version 1.0.0 is a malicious package masquerading as a utility helper for n8n workflow automation. It contains a minimal stub node with no real functionality, serving as a cover for malicious behavior. During installation, it executes a postinstall hook that collects system information (user ID and hostname), downloads a malicious tarball from an external URL with TLS verification disabled, and extracts it into the Python site-packages directory. This allows remote code execution on subsequent Python imports. The package also probes the host for offensive security tools and exfiltrates collected data encoded in base64 to a remote server. This behavior enables attackers to gain persistent code execution and gather reconnaissance data from infected systems.

Impact

This package enables remote attackers controlling the tarball URL to execute arbitrary code on the victim's system with the privileges of the user installing the package. The malicious postinstall script also performs reconnaissance by detecting offensive security tools on the host and exfiltrates sensitive system information. This can lead to persistent compromise, data leakage, and further exploitation of the affected environment.

Defensive guidance

Users should avoid installing @years19/n8n-nodes-utils-helper-b version 1.0.0. Remove any installations of this package and investigate systems for signs of compromise, especially presence of the downloaded tarball in Python site-packages and network connections to jasabersama.id. Use trusted sources and verify package integrity before installation. Monitor for suspicious postinstall scripts in npm packages.

Summary

The @years19/n8n-nodes-utils-helper-b npm package (version 1.0.0) is a malicious dropper disguised as a utility helper for n8n automation. Its main node is a non-functional stub, while the postinstall script executes commands to gather system information and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz without proper TLS verification. This tarball is extracted into the Python site-packages directory, enabling arbitrary code execution on future Python imports. Additionally, the package scans for offensive security tools such as PyRoxy, impacket, and MHDDoS start.py, then encodes and exfiltrates this reconnaissance data along with system identifiers to https://jasabersama.id/portfolio-data.php. The declared utility purpose is a cover for this malicious activity.

References

npmjs.com/package/@years19/n8n-nodes-utils-helper-b/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:24 UTC

Technical details

References

Community reviews