Malicious code in @years18/n8n-nodes-utils-helper-g (npm)
The npm package @years18/n8n-nodes-utils-helper-g contained malicious code in its postinstall script and main entry point that fetches and executes the MHDDoS/PyRoxy denial-of-service botnet, while exfiltrating host identification data to a remote server.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed or imported the @years18/n8n-nodes-utils-helper-g package; systems become infected with MHDDoS/PyRoxy botnet malware and exfiltrate host identification data.
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-gnpm package containing malicious postinstall script and main entry point
The npm package @years18/n8n-nodes-utils-helper-g was published with malicious code embedded in both its postinstall script (callback.js) and declared main entry point (index.js). The malicious code is triggered during npm install via the postinstall hook and again on any require() or import of the package.
The payload fetches a tarball and Python pip installer from https://jasabersama.id over HTTPS with certificate verification disabled (rejectUnauthorized:false), extracts the contents to /tmp/mhddos, installs Python dependencies with python3 get-pip.py --break-system-packages, and executes python3 /tmp/mhddos/start.py. The fetched project is identified as the MHDDoS/PyRoxy denial-of-service tool.
In parallel, the malicious code collects system information including the installer's host ID, hostname, $HOME directory, and environment classification (WSL/VM/container detection). This data is base64-encoded and sent as a query-string parameter to https://jasabersama.id/portfolio-data.php. The request includes a c= parameter containing a shell command intended to write the decoded blob to /tmp/n8n_rce_result.txt on the attacker's server.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-g
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-g from all systems
- Audit npm install logs and package-lock.json to identify when the package was installed
- Scan systems for the presence of /tmp/mhddos directory and MHDDoS/PyRoxy processes
- Review system logs for suspicious Python execution and outbound connections to jasabersama.id
- Check for exfiltrated data and unauthorized DDoS activity originating from affected systems
- Regenerate credentials and SSH keys on any affected systems
- Block jasabersama.id at the network perimeter
- Review npm package dependencies to ensure no other malicious packages are present
Sources
- GitHub Advisory GHSA-gp8x-fpgr-97j6 · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-g (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-g-npm-1ns8hd
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit