Malicious code in @years17/n8n-nodes-utils-helper-b (npm)
The npm package @years17/n8n-nodes-utils-helper-b contained malicious code that harvested credentials and system information via postinstall scripts and runtime execution. The package exfiltrated sensitive data including SSH keys, Kubernetes configs, cloud credentials, and environment variables to an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- Any system installing @years17/n8n-nodes-utils-helper-b; particularly n8n deployments and CI/CD environments with access to credentials, SSH keys, Kubernetes configs, and cloud credentials.
- Ecosystems
- Attack vectors
- Affected entities
- @years17/n8n-nodes-utils-helper-bMalicious npm package containing credential harvesting and reconnaissance code
The npm package @years17/n8n-nodes-utils-helper-b was published with embedded malicious code designed to harvest credentials and reconnaissance data from infected systems. The attack operated through two primary vectors: a postinstall script and code executed at require time.\n\nThe postinstall script collected system information including user IDs, hostnames, Docker socket state, sudo privileges, running containers, SSH authorized keys, and environment variables matching patterns for Docker, n8n, secrets, tokens, keys, and passwords. The main module additionally accessed Kubernetes configuration files (~/.kube/config), SSH directories, and Google Cloud credentials (~/.config/gcloud/application_default_credentials.json).\n\nAll harvested data was base64-encoded and exfiltrated to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj via HTTPS with certificate verification disabled. The package also included a malicious n8n node (PwnNode.node.js) that executed arbitrary system reconnaissance commands within the n8n runtime environment.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13871).
Indicators of compromise
- Packages
- @years17/n8n-nodes-utils-helper-b
- Domains
- jasabersama.id
Remediation
- Immediately remove @years17/n8n-nodes-utils-helper-b from all systems and dependency trees
- Audit all systems that installed this package for unauthorized access or credential compromise
- Rotate all credentials (SSH keys, API tokens, cloud credentials, database passwords) that may have been exposed
- Review system logs and network traffic for connections to jasabersama.id or exfiltration of sensitive data
- Implement package verification and scanning in CI/CD pipelines to detect malicious packages before installation
- Use npm audit and security scanning tools to identify other potentially compromised dependencies
Sources
- GitHub Advisory GHSA-fwpm-x236-m263 · GitHub Advisory Database
Cite this entry
"Malicious code in @years17/n8n-nodes-utils-helper-b (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years17-n8n-nodes-utils-helper-b-npm-1r3rqx
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit