Malicious code in @years18/n8n-nodes-utils-helper-p (npm)
The npm package @years18/n8n-nodes-utils-helper-p contained malicious code that, upon installation, downloads DDoS attack tools (MHDDoS and pyroxy), installs network-attack dependencies, and converts the host into a DDoS attack node while exfiltrating system information to attacker-controlled infrastructure.
- Disclosed
- Last updated
- Blast radius
- Any host installing the malicious package becomes a DDoS attack node; data exfiltration of system identifiers (id, hostname) to attacker infrastructure.
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-pMalicious npm package masquerading as n8n community utility-node helper
The npm package @years18/n8n-nodes-utils-helper-p was published with malicious postinstall hooks designed to compromise the installer's system. The package falsely advertised itself as an n8n community utility-node helper but contained a node file named nodes/PwnNode.node.js, revealing its true intent.
Upon installation, the postinstall script (node callback.js) fetches two tarballs—mhddos.tgz and pyroxy.tgz—from jasabersama.id with TLS verification disabled. These are extracted to /tmp and the Python user site-packages directory. The script then installs network-attack Python dependencies using pip install --break-system-packages and executes python3 start.py on the extracted MHDDoS code, converting the host into a DDoS attack node.
In parallel, the postinstall hook captures system information (output of id and hostname commands) along with installation progress, base64-encodes the data, and sends it to https://jasabersama.id/portfolio-data.php as a query parameter, also with certificate verification disabled. This enables the attacker to track compromised systems and their identities.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-p
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-p from all systems
- Audit npm package.json and lock files for any installations of this package
- Inspect affected systems for signs of DDoS attack tools (MHDDoS, pyroxy) in /tmp and Python site-packages
- Review network logs for outbound connections to jasabersama.id
- Monitor affected hosts for unexpected network activity or DDoS participation
- Use npm audit to identify and remove any other malicious packages from the same publisher (@years18)
- Consider blocking jasabersama.id at the network perimeter
Sources
- GitHub Advisory GHSA-jxpr-3hh5-66v6 · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-p (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-p-npm-arhbrp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit