Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package '@years19/n8n-nodes-utils-helper-d' version 1.0.0 is a malicious package masquerading as a community node for the n8n workflow automation tool. Its postinstall script downloads and installs a malicious Python package that shadows a legitimate module, enabling execution of attacker-supplied code. It also collects system information and sends it to an attacker-controlled server. The package contains no legitimate functionality and acts as a dropper for offensive tools consistent with DDoS activity.
AI Analysis
Technical Summary
The '@years19/n8n-nodes-utils-helper-d' npm package (version 1.0.0) pretends to be an n8n community node but executes malicious behavior during installation. Its postinstall script fetches a tarball from a remote server with TLS certificate validation disabled, extracting it into the Python site-packages directory to shadow the legitimate 'multidict' module. This enables execution of attacker-controlled Python code when 'multidict' is imported. The script also runs system commands ('id' and 'hostname'), encodes their output, probes for the dropped Python libraries, and sends this data to an attacker endpoint, effectively beaconing the compromised host. The package includes a stub node file with no real functionality and is linked to offensive tooling consistent with DDoS attacks.
Potential Impact
Installation of this package results in execution of arbitrary attacker code on the host system via Python module shadowing. It compromises system integrity by installing offensive tools and exfiltrates system identity information to an attacker-controlled server. This can lead to unauthorized control, participation in DDoS attacks, and further compromise of the affected environment.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing '@years19/n8n-nodes-utils-helper-d' version 1.0.0 and remove it immediately if present. Users should verify the authenticity of npm packages before installation and rely on trusted sources. Monitor for any signs of compromise related to this package and remove any dropped malicious Python modules and scripts.
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
Description
The npm package '@years19/n8n-nodes-utils-helper-d' version 1.0.0 is a malicious package masquerading as a community node for the n8n workflow automation tool. Its postinstall script downloads and installs a malicious Python package that shadows a legitimate module, enabling execution of attacker-supplied code. It also collects system information and sends it to an attacker-controlled server. The package contains no legitimate functionality and acts as a dropper for offensive tools consistent with DDoS activity.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The '@years19/n8n-nodes-utils-helper-d' npm package (version 1.0.0) pretends to be an n8n community node but executes malicious behavior during installation. Its postinstall script fetches a tarball from a remote server with TLS certificate validation disabled, extracting it into the Python site-packages directory to shadow the legitimate 'multidict' module. This enables execution of attacker-controlled Python code when 'multidict' is imported. The script also runs system commands ('id' and 'hostname'), encodes their output, probes for the dropped Python libraries, and sends this data to an attacker endpoint, effectively beaconing the compromised host. The package includes a stub node file with no real functionality and is linked to offensive tooling consistent with DDoS attacks.
Potential Impact
Installation of this package results in execution of arbitrary attacker code on the host system via Python module shadowing. It compromises system integrity by installing offensive tools and exfiltrates system identity information to an attacker-controlled server. This can lead to unauthorized control, participation in DDoS attacks, and further compromise of the affected environment.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing '@years19/n8n-nodes-utils-helper-d' version 1.0.0 and remove it immediately if present. Users should verify the authenticity of npm packages before installation and rely on trusted sources. Monitor for any signs of compromise related to this package and remove any dropped malicious Python modules and scripts.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13887
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b2ebf8831d539cdb707
Added to database: 08/12/2026, 16:11:26 UTC
Last enriched: 08/12/2026, 16:24:12 UTC
Last updated: 08/12/2026, 16:24:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.