MalwarePublished 12 Aug 2026

@years19/n8n-nodes-utils-helper-q (npm) · Malicious Code

Affects @years19/n8n-nodes-utils-helper-qSource GCVE Database

Malicious package : remove @years19/n8n-nodes-utils-helper-q and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:29 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13900

What to do

Remove @years19/n8n-nodes-utils-helper-q from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years19/n8n-nodes-utils-helper-q	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years19/n8n-nodes-utils-helper-q version 1.0.0 contains malicious code that executes automatically during installation and import. It downloads multiple tarballs from an attacker-controlled server with disabled TLS verification, extracts them, and runs a Python script to launch DDoS attacks against a specific IP address. Additionally, it exfiltrates system identity information to the attacker. This behavior turns the installer's machine into a bot for network abuse and compromises host privacy.

Impact

Installation or import of this package results in the compromised host being used as a node in a distributed denial-of-service (DDoS) attack against a hardcoded IP address. Additionally, sensitive system information (user and hostname) is exfiltrated to an attacker-controlled server. This compromises the confidentiality and availability of the affected system and potentially other network targets.

Defensive guidance

Users should avoid installing or importing @years19/n8n-nodes-utils-helper-q@1.0.0. Remove any existing installations of this package immediately. Monitor for any unauthorized network traffic indicative of DDoS activity or data exfiltration. Consider using trusted package sources and verifying package integrity before installation.

Summary

The package @years19/n8n-nodes-utils-helper-q@1.0.0 includes two identical scripts (callback.js and index.js) that execute on npm install and on require/import. These scripts download several tarballs (mhddos, pyroxy, impacket, multidict) from jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false). The tarballs are extracted to /tmp, and a Python script (start.py) is launched in the background to perform UDP, TCP, and HTTP GET flood attacks targeting IP 103.118.252.21. Concurrently, the scripts run 'id' and 'hostname' commands, base64-encode their output, and send it via HTTPS GET to jasabersama.id/portfolio-data.php, exfiltrating host identity data. This constitutes an install-time remote code execution and dropper mechanism that abuses the host for DDoS attacks and leaks sensitive information.

References

npmjs.com/package/@years19/n8n-nodes-utils-helper-q/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:29 UTC

Technical details

References

Community reviews