MalwarePublished 12 Aug 2026

@years20/n8n-nodes-utils-helper-a (npm) · Malicious Code

Affects @years20/n8n-nodes-utils-helper-aSource GCVE Database

Malicious package : remove @years20/n8n-nodes-utils-helper-a and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:25 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13909

What to do

Remove @years20/n8n-nodes-utils-helper-a from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@years20/n8n-nodes-utils-helper-a	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @years20/n8n-nodes-utils-helper-a version 1.0.0 contains malicious code that executes during installation and module import. It collects system identifiers and SSH host key fingerprints, sending them to a hardcoded external server. The package also deploys an embedded private SSH key locally and attempts to SSH into local accounts, reporting successful logins back to the attacker. Additionally, it establishes a server-side command channel via a remote PHP handler, enabling execution of arbitrary commands.

Impact

This malicious package compromises system confidentiality and integrity by exfiltrating sensitive system information and SSH credentials to an attacker-controlled server. It enables unauthorized SSH access to the local machine and establishes a remote command execution channel, potentially allowing full system compromise. The automatic execution on install and import increases the risk of unnoticed infection in environments using this package.

Defensive guidance

Users should immediately remove version 1.0.0 of @years20/n8n-nodes-utils-helper-a from their environments. Avoid installing or importing this package. Monitor for any unauthorized SSH activity or connections to the indicated external domain. Since this is a malicious package, the best mitigation is to avoid use and remove any existing installations.

Summary

The malicious npm package @years20/n8n-nodes-utils-helper-a (version 1.0.0) includes a postinstall script and main module that execute automatically on installation and import. These scripts gather system information such as user ID, hostname, WSL indicators, and SSH host key fingerprints, encoding and exfiltrating this data to a hardcoded URL (https://jasabersama.id/portfolio-data.php) with disabled TLS verification. The payload also writes a base64-decoded OpenSSH ed25519 private key to /tmp/pk with restricted permissions and attempts SSH logins to localhost on ports 22495 and 22 using common usernames. Successful logins are reported back to the attacker. The exfiltration endpoint accepts URL-encoded shell commands, indicating a remote command execution channel controlled by the attacker. This behavior occurs both at npm install time and when the module is required by consuming software such as n8n.

References

npmjs.com/package/@years20/n8n-nodes-utils-helper-a/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:25 UTC

Technical details

References

Community reviews