Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

The npm package @years18/n8n-nodes-utils-helper-o contained malicious code disguised as an n8n community node. On installation, a postinstall script fetched and executed a DDoS tool (MHDDoS) and installed Python DDoS dependencies, while exfiltrating system information to a remote server.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any user who installed the malicious package; potential for widespread DDoS botnet recruitment.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • @years18/n8n-nodes-utils-helper-o

The package @years18/n8n-nodes-utils-helper-o was published to npm as a purported n8n community utility node but contained a malicious postinstall payload. The stub node file (nodes/PwnNode.node.js) served only as cover; the real behavior was triggered during installation via callback.js.

Upon installation, the postinstall script disabled TLS verification and fetched two tarballs from jasabersama.id. One was extracted to /tmp/mhddos (the MHDDoS DDoS tool), and the other into the user's Python site-packages directory. The script then installed Python DDoS-support dependencies via pip with the --break-system-packages flag and executed python3 start.py from the MHDDoS archive.

The same script executed system reconnaissance commands (id, hostname), base64-encoded the output along with installation progress markers, and sent the data via HTTPS GET requests to jasabersama.id/portfolio-data.php, again with TLS verification disabled. This behavior indicates the package was designed to recruit infected systems into a DDoS botnet while exfiltrating identifying information.

The incident was identified and credited to the OpenSSF's malicious-packages repository.

Indicators of compromise

Packages
  • @years18/n8n-nodes-utils-helper-o
Domains
  • jasabersama.id

Remediation

  • Immediately uninstall @years18/n8n-nodes-utils-helper-o from all affected systems
  • Audit npm install logs and package-lock.json to identify when and where the package was installed
  • Inspect /tmp/mhddos and Python site-packages for remnants of the MHDDoS tool and DDoS dependencies; remove if present
  • Review system logs for suspicious outbound HTTPS connections to jasabersama.id
  • Check for unauthorized cron jobs, systemd timers, or other persistence mechanisms that may have been installed
  • Monitor affected systems for signs of DDoS botnet activity or command-and-control communication
  • Update npm and verify the integrity of other installed packages
  • Consider rebuilding or reimaging systems that installed this package if compromise is suspected

Sources

  1. GitHub Advisory GHSA-pq66-q4c3-fchm · GitHub Advisory Database

Cite this entry

"Malicious code in @years18/n8n-nodes-utils-helper-o (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-o-npm-37l1br

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malware in sui-gql-core

    Malware was discovered in the npm package sui-gql-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.

    npmCompromised package
  2. containedcritical

    Malware in @junofficial/baileys

    The npm package @junofficial/baileys contained malware that fully compromised any system with the package installed or running. The malicious package has been identified and removed from distribution.

    npmCompromised package
  3. containedcritical

    Malware in a.poltoradnev-package-a

    The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.

    npmCompromised package
  4. containedcritical

    Malware in sui-move-rpc

    Malware was discovered in the npm package sui-move-rpc, resulting in full system compromise of any computer with the package installed or running. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a different computer.

    npmCompromised package