Malicious code in @years18/n8n-nodes-utils-helper-j (npm)
The npm package @years18/n8n-nodes-utils-helper-j contained malicious code that executed a DDoS tool (MHDDoS) on install and import, exfiltrated host reconnaissance data, and downloaded additional payloads from an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- Any system installing @years18/n8n-nodes-utils-helper-j or importing it in n8n; systems executing the downloaded MHDDoS payload
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-jMalicious npm package presenting as n8n community node utility helper
The npm package @years18/n8n-nodes-utils-helper-j was published with malicious code embedded in its postinstall hook and main entrypoint. The package falsely presented itself as an n8n community node utility helper but contained no legitimate functionality.
Upon installation and when required by n8n, the package executed remote code that downloaded mhddos.tgz and get-pip.py from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS verification disabled. The downloaded files were extracted to /tmp/mhddos and the MHDDoS DDoS tool was executed via python3 start.py after pip-installing dependencies with --break-system-packages.
Before executing the payload, the malicious code collected host reconnaissance data including user ID, hostname, WSL/VM/container classification, $HOME directory, and shell command outputs. This data was base64-encoded and exfiltrated via HTTPS GET request to https://jasabersama.id/portfolio-data.php with the recon data in the c query parameter.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-j
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-j from all systems
- Audit npm package.json and lock files for any presence of this package
- Review system logs and process execution history on affected hosts for evidence of MHDDoS execution or data exfiltration
- Check for outbound HTTPS connections to jasabersama.id during the installation window
- Regenerate credentials and SSH keys on affected systems
- Monitor for DDoS tool artifacts in /tmp/mhddos
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-mcph-2x3g-8j4h · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-j (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-j-npm-1ejq6o
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit