npm · Malicious package advisory
Malware@years18/n8n-nodes-utils-helper-d
GHSA-x25g-8xwh-r682
Malicious code in @years18/n8n-nodes-utils-helper-d (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.0.0`
## Source: amazon-inspector (0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e)
Package is presented as an n8n community node but the only node file (nodes/PwnNode.node.js) is a 213-byte stub; the real behavior is in callback.js, which is invoked by the postinstall lifecycle hook ("postinstall": "node callback.js"). On install, callback.js performs three attacker-benefit actions against the installer's host: (1) it fetches https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over TLS with certificate validation disabled (rejectUnauthorized: false), writes it to /tmp/mhddos.tgz, extracts it, pip-installs its declared requirements, and runs python3 start.py — unattended remote code execution of a mutable third-party archive labelled after the mhddos DDoS tool family; (2) it runs `id` and `hostname` and probes an internal TCP endpoint, base64-encodes the combined output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, leaking installer identity and network state to the same author-controlled host; (3) it executes `bash -c 'echo > /dev/tcp/10.131.106.93/8888'` against a hardcoded RFC1918 address (with a source comment referring to Sliver, an offensive C2 framework) and reports reachability back — internal-network reconnaissance consistent with lateral-movement staging. index.js contains the same payload as callback.js, ensuring the code also runs on require of the module.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-d/MAL-2026-13850.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/npm/@years18/n8n-nodes-utils-helper-d/MAL-2026-13850.json
- https://www.npmjs.com/package/@years18/n8n-nodes-utils-helper-d/v/1.0.0
- https://github.com/advisories/GHSA-x25g-8xwh-r682Compromised versions (1)
- = 1.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.