MalwarePublished 12 Aug 2026

@years19/n8n-nodes-utils-helper-s (npm) · Malicious Code

Affects @years19/n8n-nodes-utils-helper-sSource GCVE Database

Malicious package : remove @years19/n8n-nodes-utils-helper-s and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13902

What to do

Remove @years19/n8n-nodes-utils-helper-s from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years19/n8n-nodes-utils-helper-s	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years19/n8n-nodes-utils-helper-s version 1.0.0 contains malicious code that executes during installation and module import. It writes and launches a Python script that performs a UDP/TCP flood attack against a hardcoded IP address for 600 seconds. Additionally, it collects host system information, encodes it, and exfiltrates it to a remote server with disabled TLS verification. The package masquerades as a utility node for n8n but has no legitimate functionality, instead using the host as a bot for DDoS attacks and reconnaissance.

Impact

This malicious package compromises the host by executing a DDoS attack against a third-party IP, potentially implicating the host in attack traffic. It also performs host reconnaissance and exfiltrates sensitive system information to an attacker-controlled server, risking privacy and security of the affected system. The attack runs silently during installation and module import, increasing the risk of unnoticed compromise.

Defensive guidance

Avoid installing or using the @years19/n8n-nodes-utils-helper-s package version 1.0.0. Remove the package if already installed and investigate any suspicious network activity or system changes. Monitor for any communications to jasabersama.id and block outbound traffic to this domain if possible. Verify package sources carefully before installation to prevent supply chain compromise.

Summary

The malicious npm package @years19/n8n-nodes-utils-helper-s version 1.0.0 includes a postinstall script that writes /tmp/attack.py, a Python UDP/TCP flooder targeting IP 103.118.252.21 on ports 80 and 443 for 600 seconds, and runs it in the background. The same malicious code is triggered when requiring the module via index.js, bypassing --ignore-scripts flags. The package also collects host identity data (user id, hostname, process list, load average), base64-encodes it, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled, exposing the host to reconnaissance and data exfiltration. The package falsely claims to be an n8n utility node but solely functions as malware for DDoS and data theft.

References

npmjs.com/package/@years19/n8n-nodes-utils-helper-s/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:28 UTC

Technical details

References

Community reviews