Malicious code in @years18/n8n-nodes-utils-helper-b (npm)
The npm package @years18/n8n-nodes-utils-helper-b contained malicious code in its postinstall script that downloads and executes a Python-based remote access implant (mhddos) from an attacker-controlled server. The package masqueraded as a workflow-automation helper while performing reconnaissance and executing arbitrary code on installation.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious npm package @years18/n8n-nodes-utils-helper-b
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-bMalicious npm package with postinstall script executing remote payload
The npm package @years18/n8n-nodes-utils-helper-b was published with a malicious postinstall script that executes node callback.js. This script downloads a tarball (mhddos.tgz) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over a TLS-verification-disabled HTTPS connection, extracts it to /tmp/mhddos, installs Python dependencies, and runs python3 start.py.\n\nIn parallel, the postinstall script collects system information including the output of id and hostname commands, along with logs from the tar extraction, pip installation, and Python execution steps. This data is base64-encoded and exfiltrated to https://jasabersama.id/portfolio-data.php (also with certificate validation disabled).\n\nThe malicious behavior is evidenced by internal identifiers such as IMPLANT_PROC and result files like /tmp/n8n_rce_result.txt, which indicate remote code execution capability rather than legitimate helper functionality. The fetched Python payload (mhddos) is attacker-controlled code that executes automatically upon npm install.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project (MAL-2026-13848).
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-b
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-b from all systems
- Audit npm install logs and package-lock.json files to identify all systems that installed this package
- Inspect affected systems for the presence of /tmp/mhddos directory and /tmp/n8n_rce_result.txt file
- Review system logs and network traffic for connections to jasabersama.id
- Assume any system that installed this package has been compromised; perform full forensic analysis and remediation
- Update npm audit tools and dependency scanning to detect and block this package
- Review and strengthen npm package vetting processes to catch postinstall script anomalies
Sources
- GitHub Advisory GHSA-vf93-4649-9mf6 · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-b (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-b-npm-hg4t66
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit