@years18/n8n-nodes-utils-helper-s

GHSA-jj25-9gc3-x3j5

Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (791cd15471cd2592323fdd5d9b58f79903e29a77b73384d0fd8b1bc7b4b43342)
The package's postinstall lifecycle script downloads two tarballs (mhddos.tgz, pyroxy.tgz) from jasabersama.id over an HTTPS connection with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp and into the Python user site-packages, pip-installs a fixed dependency set with --break-system-packages, and immediately runs `python3 start.py` from the extracted mhddos directory. In parallel, it collects the output of `id` and `hostname` plus install-progress markers, base64-encodes them, and sends them as a query-string parameter to https://jasabersama.id/portfolio-data.php with a fixed key `S7k9xQ2mZj`. The payload URL is staged under a `.theme-backup/dl/` cover-story path on a domain unrelated to the package's declared purpose, and the package's n8n node file is a stub — the sole functional code is the malicious postinstall. The name mimics legitimate n8n community node packages.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-s/MAL-2026-13863.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-s/MAL-2026-13863.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-s/v/1.0.0
- https://github.com/advisories/GHSA-jj25-9gc3-x3j5

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.