Supply chain · npm · High

Critical Malicious npm Package: @years18/n8n-nodes-utils-helper-t

Threat Engine Auto-Feed · data current as of 2026-08-12

A critical malicious npm package, `@years18/n8n-nodes-utils-helper-t` version 1.0.0, has been identified. This package executes a payload upon installation or import, establishing a command-and-control channel and deploying a DDoS toolkit. Organizations using this package are at high risk of system compromise and resource abuse.

  • Package: npm / @years18/n8n-nodes-utils-helper-t
  • Affected versions: = 1.0.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package `@years18/n8n-nodes-utils-helper-t` version 1.0.0 contains malicious code that runs automatically via its `postinstall` script and main entry point. This code collects system information, establishes a remote command channel, and installs a DDoS toolkit on the host system. The package name is designed to mimic legitimate n8n community nodes to trick users into installing it.

How the attack works

This is a malicious package attack where an attacker publishes a seemingly benign or useful library that, when installed or imported, executes unauthorized code. The malicious code typically runs during the package's lifecycle events (e.g., `postinstall` scripts) or upon its first use, allowing the attacker to gain control over the system where the package is installed. This particular package establishes a covert communication channel and deploys additional malicious software.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that automatically pull package dependencies
  • Organizations whose developers might install community n8n nodes

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest version of a package
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure consistent dependency versions
  • Use of internal package mirrors that do not vet packages for malicious content
  • Systems with network access to external command-and-control infrastructure

Blast-radius scenarios

  • Attacker establishes a remote command-and-control channel on the compromised host, enabling further arbitrary command execution.
  • Attacker deploys a DDoS toolkit, potentially using the compromised host as part of a botnet for denial-of-service attacks.
  • Sensitive system information (e.g., `id`, `hostname`) is exfiltrated to an external server.
  • Compromised systems could be used as pivot points for lateral movement within the network.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `@years18/n8n-nodes-utils-helper-t` version 1.0.0.
  • Monitor network traffic for connections to `https://jasabersama.id/portfolio-data.php`.
  • Look for unusual file creations or modifications, specifically `/tmp/n8n_rce_result.txt` and `/tmp/mhddos`.
  • Check for unexpected `pip install impacket` commands or `python3 start.py` executions related to `/tmp/mhddos`.

Contain

  • Immediately isolate any systems found to have installed `@years18/n8n-nodes-utils-helper-t` version 1.0.0.
  • Block network access to `https://jasabersama.id/portfolio-data.php` at the firewall or proxy level.
  • Suspend or revoke credentials used on compromised systems, especially those with elevated privileges.
  • Review and update CI/CD pipeline configurations to prevent automatic installation of unvetted packages.

Remediate

  • Remove `@years18/n8n-nodes-utils-helper-t` from all `package.json` and `package-lock.json` files.
  • Rebuild affected systems from trusted images, ensuring all dependencies are verified.
  • Implement strict dependency pinning using `package-lock.json` or `npm-shrinkwrap.json` and review changes.
  • Educate developers on the risks of installing packages from unknown or suspicious sources and the importance of verifying package authenticity.

Frontier verdict — High

Prioritize immediate detection and removal of `@years18/n8n-nodes-utils-helper-t` due to critical severity, command-and-control capabilities, and DDoS toolkit deployment.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.