@years19/n8n-nodes-utils-helper-gnpm
Advisory published Updated
@years19/n8n-nodes-utils-helper-g is a confirmed malicious npm package (MAL-2026-13890) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @years19/n8n-nodes-utils-helper-g (npm)
What this malware does
The package's postinstall script (callback.js) and its declared main entrypoint (index.js) contain byte-identical dropper code that runs on npm install and on require of the module. The code downloads multiple tarballs (mhddos.tgz, pyroxy-full.tgz, impacket.tgz, multidict) from https://jasabersama.id with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp/mhddos and the Python user-site directory, and invokes python3 start.py on the extracted payload. The same code collects the output of id and hostname along with execution results, base64-encodes the buffer, and transmits it via HTTPS GET to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<payload>. The fetched tooling (mhddos, PyRoxy, impacket) is offensive network-attack software staged and launched on the installer's host at install time.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for @years19/n8n-nodes-utils-helper-g (version 1.0.0).
If you installed it — respond
Remove @years19/n8n-nodes-utils-helper-g from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If @years19/n8n-nodes-utils-helper-g was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @years19/n8n-nodes-utils-helper-g-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.