Malicious code in @years18/n8n-nodes-utils-helper-w (npm)
The npm package @years18/n8n-nodes-utils-helper-w contained malicious code that executed on install and require, running reconnaissance commands, installing the MHDDoS attack toolkit, and exfiltrating system information to a remote server.
- Disclosed
- Last updated
- Blast radius
- Any system that installed the malicious package version
- Ecosystems
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-wMalicious npm package masquerading as n8n workflow helper
The npm package @years18/n8n-nodes-utils-helper-w was published with malicious code disguised as an n8n workflow helper utility. The package contained a minimal legitimate stub (PwnNode.node.js) while the actual payload was embedded in both the postinstall hook and the main entry point (index.js and callback.js, which are byte-identical).
Upon installation or require(), the payload executed reconnaissance commands (id, hostname), probed for Python packages, and installed the MHDDoS distributed denial-of-service toolkit from /tmp/mhddos/start.py. The malicious code also executed python3 -m pip install --quiet --break-system-packages impacket, mutating the system Python environment without user consent.
The exfiltration mechanism sent base64-encoded output to https://jasabersama.id/portfolio-data.php as URL query parameters over HTTPS with TLS verification disabled (rejectUnauthorized:false). The mismatch between the advertised purpose and actual functionality, combined with payload duplication across auto-executed surfaces, indicates intentional deception.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-w
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-w from all systems
- Audit npm install logs to identify affected systems and installation timestamps
- Review system logs for execution of id, hostname, and Python package installation commands
- Check for presence of /tmp/mhddos/ directory and MHDDoS toolkit artifacts
- Inspect Python environment for unexpected impacket package installation
- Monitor outbound HTTPS connections to jasabersama.id for data exfiltration
- Regenerate credentials and secrets on affected systems
- Consider full system reimaging if the package was installed in production environments
- Review npm package dependencies to identify if this package was a transitive dependency
Sources
- GitHub Advisory GHSA-hf7f-9vj2-cw9w · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-w (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-w-npm-xn5yo1
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit