@years18/n8n-nodes-utils-helper-r

GHSA-778r-j46v-qgf3

Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb)
@years18/n8n-nodes-utils-helper-r ships a postinstall script that, on `npm install`, downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy-full.tgz over TLS with certificate verification disabled and extracts it into the installer's Python site-packages directory, then verifies the drop by executing `python3 start.py` from /tmp/mhddos. The dropped payload is the PyRoxy / MHDDOS DDoS attack framework. The same postinstall collects the output of `id` and `hostname`, base64-encodes the result, and sends it via HTTPS GET (certificate verification disabled) to jasabersama.id/portfolio-data.php with a hardcoded key parameter. The package presents itself as an n8n community utility node, but the delivered payload is unrelated offensive tooling.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-r/MAL-2026-13862.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-r/MAL-2026-13862.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-r/v/1.0.0
- https://github.com/advisories/GHSA-778r-j46v-qgf3

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.