@years18/n8n-nodes-utils-helper-t

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea)
The package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on `npm install` and on `require()`. The payload runs `id` and `hostname`, base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php with `k=` and `c=` query parameters; TLS certificate verification is disabled (`rejectUnauthorized:false`). The `c=` parameter carries a base64-decode-and-append shell command written to /tmp/n8n_rce_result.txt, giving the operator a server-driven command channel. The same script pip-installs `impacket` with `--break-system-packages`, probes for `PyRoxy`, and executes `python3 start.py` under /tmp/mhddos — staging and running an mhddos DDoS toolkit on the installer host. The package name mimics a legitimate n8n community node to lure installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-t/MAL-2026-13864.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-t/MAL-2026-13864.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-t/v/1.0.0
- https://github.com/advisories/GHSA-m6wf-448f-8pww

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.