@years18/n8n-nodes-utils-helper-p

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804)
Package advertises itself as an n8n community utility-node helper but its postinstall hook (`node callback.js`) fetches two tarballs from jasabersama.id (mhddos.tgz and pyroxy.tgz) with TLS verification disabled, extracts them to /tmp and the Python user site-packages, installs network-attack Python dependencies via `pip install --break-system-packages`, and runs `python3 start.py` on the extracted MHDDoS code — turning the installer's host into a DDoS attack node. The same postinstall captures `id` and `hostname` output plus install progress, base64-encodes it, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate verification disabled). The shipped node file is named `nodes/PwnNode.node.js`, contradicting the package's stated benign purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-p/MAL-2026-13860.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-p/MAL-2026-13860.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-p/v/1.0.0
- https://github.com/advisories/GHSA-jxpr-3hh5-66v6

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.