MalwarePublished 12 Aug 2026

@years19/n8n-nodes-utils-helper-m (npm) · Malicious Code

Affects @years19/n8n-nodes-utils-helper-mSource GCVE Database

Malicious package : remove @years19/n8n-nodes-utils-helper-m and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:26 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13896

What to do

Remove @years19/n8n-nodes-utils-helper-m from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years19/n8n-nodes-utils-helper-m	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years19/n8n-nodes-utils-helper-m version 1.0.0 contains malicious code that executes during installation. Its postinstall script downloads multiple Python tools from an attacker-controlled server with disabled TLS verification, installs them, and launches Python processes that perform DDoS attacks against a hardcoded target. It also collects system information and exfiltrates it to the attacker, who can write arbitrary base64-decoded content to the local filesystem. The package name suggests legitimate utility functionality, but no such features exist in the code.

Impact

Hosts that install this package are compromised by running unauthorized Python processes that participate in DDoS attacks against a fixed target, potentially implicating the victim in malicious network activity. The attacker gains system information and can write arbitrary files to the victim's filesystem, which may facilitate further compromise or persistence. This undermines system integrity and confidentiality.

Defensive guidance

Users should avoid installing @years19/n8n-nodes-utils-helper-m version 1.0.0. Remove the package and any related Python processes if already installed. Monitor systems for unexpected Python processes and network traffic to the specified attacker domains or IP addresses. Verify package authenticity before installation and prefer trusted sources.

Summary

The malicious npm package @years19/n8n-nodes-utils-helper-m (version 1.0.0) includes a postinstall script that fetches several Python packages (mhddos, PyRoxy, impacket, multidict) from a remote server over HTTPS with TLS verification disabled (rejectUnauthorized:false). These packages are extracted into temporary directories and the user's Python site-packages. The script then launches three persistent Python3 processes that direct traffic at a hardcoded IP address, effectively turning the host into a DDoS bot. Additionally, the script executes system commands ('id' and 'hostname'), base64-encodes their output, and sends it as a query parameter to an attacker-controlled URL. The attacker can also write arbitrary base64-decoded data to a file on the victim's system via a crafted URL parameter. Despite the package's name implying it is an n8n-nodes utility, it contains no legitimate functionality and is purely malicious.

References

npmjs.com/package/@years19/n8n-nodes-utils-helper-m/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:26 UTC

Technical details

References

Community reviews