@years18/n8n-nodes-utils-helper-tnpm
Advisory published Updated
@years18/n8n-nodes-utils-helper-t is a confirmed malicious npm package (MAL-2026-13864) that typosquats a legitimate package to trick installs (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @years18/n8n-nodes-utils-helper-t (npm)
What this malware does
The package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on npm install and on require(). The payload runs id and hostname, base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php with k= and c= query parameters; TLS certificate verification is disabled (rejectUnauthorized:false). The c= parameter carries a base64-decode-and-append shell command written to /tmp/n8n_rce_result.txt, giving the operator a server-driven command channel. The same script pip-installs impacket with --break-system-packages, probes for PyRoxy, and executes python3 start.py under /tmp/mhddos — staging and running an mhddos DDoS toolkit on the installer host. The package name mimics a legitimate n8n community node to lure installation.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Search your lockfiles and build artifacts for @years18/n8n-nodes-utils-helper-t (version 1.0.0).
If you installed it — respond
@years18/n8n-nodes-utils-helper-t is a typosquat — you almost certainly intended a legitimately-named package. Remove @years18/n8n-nodes-utils-helper-t, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If @years18/n8n-nodes-utils-helper-t was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @years18/n8n-nodes-utils-helper-t-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.