@years18/n8n-nodes-utils-helper-o

GHSA-pq66-q4c3-fchm

Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4)
The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of Python DDoS-support dependencies via pip with --break-system-packages, then executes `python3 start.py` from the extracted MHDDoS archive. The same script runs `id` and `hostname`, base64-encodes the output along with install-progress markers, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. The declared n8n utility purpose is a cover story for the install-time payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-o/MAL-2026-13859.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-o/MAL-2026-13859.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-o/v/1.0.0
- https://github.com/advisories/GHSA-pq66-q4c3-fchm

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.