Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @years18/n8n-nodes-utils-helper-m (npm)

The npm package @years18/n8n-nodes-utils-helper-m contained malicious code that executed on install and require, downloading and executing a DDoS tool (mhddos/PyRoxy) and exfiltrating system information to a remote server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed the malicious package via npm install
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • @years18/n8n-nodes-utils-helper-mMalicious npm package mimicking n8n community-nodes helper

The package @years18/n8n-nodes-utils-helper-m was published to npm with malicious intent, mimicking the name of a legitimate n8n community-nodes helper utility. The package contained identical malicious payloads in both its postinstall script (node callback.js) and main entrypoint (index.js).

Upon installation or require, the payload downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy.tgz with TLS verification disabled, extracts it into the system's Python site-packages using --break-system-packages, and executes python3 start.py from /tmp/mhddos. This installs and runs the mhddos/PyRoxy DDoS tool on the compromised system.

In parallel, the malicious code collects the installer's user ID, hostname, and command execution output, base64-encodes this information, and sends it to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=... with TLS verification disabled, exfiltrating system details to the attacker's infrastructure.

The incident was identified and credited to the OpenSSF malicious-packages repository, indicating the package has been flagged and removed from npm.

Indicators of compromise

Packages
  • @years18/n8n-nodes-utils-helper-m
Domains
  • jasabersama.id

Remediation

  • Immediately uninstall @years18/n8n-nodes-utils-helper-m from all systems
  • Audit npm install logs to identify when the package was installed
  • Scan affected systems for the presence of /tmp/mhddos and Python packages installed via --break-system-packages
  • Review system logs for suspicious outbound connections to jasabersama.id
  • Check for signs of DDoS tool execution or network-based attacks originating from affected systems
  • Verify the integrity of Python site-packages and remove any unauthorized packages
  • Use npm audit to identify and remediate any other malicious dependencies
  • Consider rotating credentials and reviewing access logs on systems where the package was installed

Sources

  1. GitHub Advisory GHSA-m72f-3v8x-rgxh · GitHub Advisory Database

Cite this entry

"Malicious code in @years18/n8n-nodes-utils-helper-m (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-m-npm-16zwh0

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in depcruise-wrap-stream-in-html (npm)

    depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.

    npmCompromised packageDependency confusionTyposquatting
  2. resolvedcritical

    Malicious code in @finaxis/common-js (npm)

    The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.

    npmCompromised packageTyposquatting
  3. resolvedcritical

    Malicious code in akamai-sensor (npm)

    A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.

    npmCompromised packageTyposquatting
  4. containedcritical

    Malicious code in axios-fast (npm)

    axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.

    npmCompromised packageTyposquatting