Malicious code in @years18/n8n-nodes-utils-helper-t (npm)
The npm package @years18/n8n-nodes-utils-helper-t contained malicious code that executed on installation and require(), exfiltrating system information, establishing a command channel, and deploying a DDoS toolkit. The package name was designed to mimic a legitimate n8n community node.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious package via npm
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-tMalicious npm package mimicking legitimate n8n community node
The npm package @years18/n8n-nodes-utils-helper-t was identified as containing malicious code that executed both during installation (via postinstall script) and at runtime (via index.js). The payload executed system reconnaissance commands (id and hostname), base64-encoded the output, and exfiltrated it to https://jasabersama.id/portfolio-data.php with disabled TLS certificate verification.
The malicious script established a command channel through the c= query parameter, allowing the attacker to write and execute arbitrary shell commands to /tmp/n8n_rce_result.txt. Additionally, the payload installed the impacket Python library with --break-system-packages and staged the mhddos DDoS toolkit in /tmp/mhddos, enabling the attacker to launch distributed denial-of-service attacks from compromised systems.
The package name was deliberately crafted to mimic a legitimate n8n community node, using typosquatting tactics to deceive developers into installing it. The incident was identified and credited to the OpenSSF malicious packages repository.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-t
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-t from all systems
- Audit npm install logs to identify when and where the package was installed
- Inspect /tmp/n8n_rce_result.txt and /tmp/mhddos directories for evidence of command execution or DDoS toolkit deployment
- Review system logs for suspicious outbound connections to jasabersama.id
- Check for unauthorized Python packages (impacket) installed with --break-system-packages
- Regenerate credentials and API keys on any system that installed this package
- Monitor affected systems for signs of DDoS activity or further compromise
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-m6wf-448f-8pww · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-t (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-t-npm-u62sp5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting