@years18/n8n-nodes-utils-helper-f

GHSA-5984-r5vf-56w4

Malicious code in @years18/n8n-nodes-utils-helper-f (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (df58050e02ff53c728a303196575150af9e64959761f10079284077b1c274572)
On npm install, the package's postinstall hook (callback.js / index.js) executes shell commands including `id` and `hostname`, probes the internal RFC1918 address 10.131.106.93:8888 via /dev/tcp, base64-encodes the collected output, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The server-side query is constructed to base64-decode the payload into /tmp/n8n_rce_result.txt. The same postinstall path invokes `python3 /tmp/get-pip.py --break-system-packages`, `pip install -r /tmp/mhddos/requirements.txt`, and `python3 start.py` from /tmp/mhddos, staging and running the mhddos DDoS framework on the installer's machine at install time. The combination yields host reconnaissance exfiltration, internal-network probing, and install-time remote code execution turning the installer into a DDoS node.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-f/MAL-2026-13852.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-f/MAL-2026-13852.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-f/v/1.0.0
- https://github.com/advisories/GHSA-5984-r5vf-56w4

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.