Malicious code in @years18/n8n-nodes-utils-helper-q (npm)
The npm package @years18/n8n-nodes-utils-helper-q contains malicious postinstall code that downloads and executes DDoS attack tools (MHDDoS and pyroxy) on the installer's host, enrolling it as a DDoS attack node. The package masquerades as a legitimate n8n helper utility node.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed @years18/n8n-nodes-utils-helper-q from npm; affected hosts become DDoS attack nodes.
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-qMalicious npm package masquerading as n8n community node
@years18/n8n-nodes-utils-helper-q is a malicious npm package that presents itself as a legitimate n8n community node with a trivial 'Helper Utils' description. However, its postinstall lifecycle script executes a hostile payload chain designed to compromise the installer's system.
Upon installation, the postinstall script fetches two archives (mhddos.tgz and pyroxy.tgz) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS verification disabled. It unpacks mhddos.tgz to /tmp/mhddos and pyroxy.tgz into the user's Python site-packages, then pip-installs DDoS runtime dependencies (pysocks, cloudscraper, dnspython, psutil, icmplib, pyasn1, yarl, requests_toolbelt, certifi) with --break-system-packages and executes python3 start.py from the MHDDoS tree, enrolling the host as a DDoS attack node.
The same postinstall script also executes id and hostname commands, base64-encodes the output along with payload-install results, and exfiltrates this data to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c= via a GET request with TLS verification disabled. The staging path and node framing serve as cover stories for the attack.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-q
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-q from all systems
- Audit npm install logs to identify all hosts that installed this package
- Terminate any processes spawned by the postinstall script (python3 start.py, mhddos, pyroxy)
- Scan affected systems for DDoS tools and malicious Python packages installed to site-packages
- Review network traffic from affected hosts for DDoS attack activity
- Reset credentials and review access logs on any systems that ran this package
- Block outbound connections to jasabersama.id
- Use npm audit to identify and remove this package from all projects
Sources
- GitHub Advisory GHSA-9g4q-f58w-2jrj · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-q (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-q-npm-496uhg
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit