Malicious code in @years17/n8n-nodes-utils-helper-c (npm)
The npm package @years17/n8n-nodes-utils-helper-c contained malicious code that performed host reconnaissance via a postinstall script and a fake n8n node, exfiltrating system information to an external C2 server. The package was identified and reported by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed @years17/n8n-nodes-utils-helper-c; postinstall script executes automatically on installation.
- Ecosystems
- Attack vectors
- Affected entities
- @years17/n8n-nodes-utils-helper-cnpm package containing malicious postinstall script and PwnNode.node.js
The npm package @years17/n8n-nodes-utils-helper-c was published with embedded malicious code designed to perform reconnaissance and establish command-and-control communication. The package contained two attack mechanisms:
Postinstall Script & C2 Communication: A postinstall script (duplicated as the main entry point) executed automatically upon installation. It ran shell commands to enumerate the host environment (id, hostname, whoami, /proc/1/cgroup, environment variables, /etc/os-release, Docker socket presence, and directory listings of /home and /root). The collected output was base64-encoded and transmitted to https://jasabersama.id/portfolio-data.php as a URL query parameter, with TLS verification disabled (rejectUnauthorized:false). The request included a static shared key (k=S7k9xQ2mZj) and a c= parameter shaped as a shell command, consistent with a C2 relay pattern.
Fake n8n Node: The package declared a malicious n8n node called HelperUtils in nodes/PwnNode.node.js that executed shell reconnaissance commands (id; hostname; uname -a; ls -la /home; ls -la /) within its execute() method and returned raw output to the workflow. The package name and description (Utility helper nodes) did not disclose either behavior.
The malicious package was identified and credited to the OpenSSF's malicious-packages project (GitHub advisory GHSA-qqrj-429c-hx78).
Indicators of compromise
- Packages
- @years17/n8n-nodes-utils-helper-c
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years17/n8n-nodes-utils-helper-c from all systems
- Audit npm package.json and lock files for any presence of this package
- Review system logs and environment variable access on any host where this package was installed
- Rotate any credentials or sensitive environment variables that may have been exposed
- Monitor outbound connections to jasabersama.id for any data exfiltration
- Use npm audit to check for other malicious packages in your dependency tree
- Consider using npm package integrity verification tools and private registry scanning
Sources
- GitHub Advisory GHSA-qqrj-429c-hx78 · GitHub Advisory Database
Cite this entry
"Malicious code in @years17/n8n-nodes-utils-helper-c (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years17-n8n-nodes-utils-helper-c-npm-xqnt7s
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit