Malicious code in @years17/n8n-nodes-utils-helper-f (npm)
The npm package @years17/n8n-nodes-utils-helper-f contains malicious code in its postinstall script and a node module that performs reconnaissance, exfiltrates system data to a C2 server, and establishes persistent SSH access. The package was identified by OpenSSF's malicious-packages project.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed @years17/n8n-nodes-utils-helper-f via npm
- Ecosystems
- Attack vectors
- Affected entities
- @years17/n8n-nodes-utils-helper-fnpm package containing malicious postinstall script and PwnNode.node.js
The npm package @years17/n8n-nodes-utils-helper-f contains multiple layers of malicious functionality. The postinstall script (duplicated in index.js) executes automatically upon npm install and performs three primary attacks: (1) reconnaissance via commands (id, sudo -n id, docker.sock check, /etc/hosts, hostname) with base64-encoded exfiltration to https://jasabersama.id/portfolio-data.php with TLS verification disabled; (2) persistence by appending an attacker SSH public key (ed25519, comment 'pwn@kali') to /home/ubuntu/.ssh/authorized_keys; (3) command-and-control signaling via a 'c=' parameter in the exfil URL.
Additionally, the package ships a malicious n8n node registered as 'nodes/PwnNode.node.js' (displayed as 'Helper Utils') that executes system reconnaissance commands (id, hostname, uname -a, directory listings) via child_process.execSync when a workflow runs, returning results with a 'pwned: true' flag.
The package was identified and documented by the OpenSSF's malicious-packages project (MAL-2026-13875) and reported via GitHub Security Advisory GHSA-qxf5-vm24-gfwp.
Indicators of compromise
- Packages
- @years17/n8n-nodes-utils-helper-f
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years17/n8n-nodes-utils-helper-f from all systems
- Audit npm install logs and package-lock.json to identify all systems that may have installed this package
- Check /home/ubuntu/.ssh/authorized_keys and other user SSH directories for the attacker public key (ed25519 key with comment 'pwn@kali') and remove if present
- Review system logs and network traffic for connections to jasabersama.id
- Rotate SSH keys and credentials on any affected systems
- Scan systems for unauthorized SSH access or persistence mechanisms
- Use npm audit to identify any other malicious dependencies in your project
Sources
- GitHub Advisory GHSA-qxf5-vm24-gfwp · GitHub Advisory Database
Cite this entry
"Malicious code in @years17/n8n-nodes-utils-helper-f (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years17-n8n-nodes-utils-helper-f-npm-fevd6k
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit