@years18/n8n-nodes-utils-helper-v

GHSA-5wrc-8g4h-mjrw

Malicious code in @years18/n8n-nodes-utils-helper-v (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f)
The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity (`id`, hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The same postinstall path installs the impacket network-attack library via `pip install --break-system-packages`, probes PyRoxy, and attempts to execute /tmp/mhddos/start.py (MHDDoS). Installing this package auto-runs reconnaissance, exfiltrates installer host identifiers to a hardcoded third-party endpoint, and stages offensive DDoS/network-attack tooling on the installer's machine.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-v/MAL-2026-13866.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-v/MAL-2026-13866.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-v/v/1.0.0
- https://github.com/advisories/GHSA-5wrc-8g4h-mjrw

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.