Malicious code in @years18/n8n-nodes-utils-helper-y (npm)
The npm package @years18/n8n-nodes-utils-helper-y contained malicious code in its postinstall hook that downloads and executes attacker-controlled Python toolkits (mhddos, pyroxy-full, impacket), persists them in the user's Python site-packages, and exfiltrates host information to an attacker-controlled endpoint. Installation triggers immediate code execution and establishes persistence.
- Disclosed
- Last updated
- Blast radius
- Any user installing @years18/n8n-nodes-utils-helper-y via npm; affected systems have malicious Python toolkits persisted in site-packages and attacker command-and-control communication established.
- Attack vectors
- Affected entities
- @years18/n8n-nodes-utils-helper-ynpm package containing malicious postinstall hook
The npm package @years18/n8n-nodes-utils-helper-y was found to contain malicious code in its postinstall hook (node callback.js). Upon installation, the hook fetches three tarballs—mhddos, pyroxy-full, and impacket—from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false).
The malicious postinstall script extracts pyroxy-full and impacket into the invoking user's Python site-packages directory, ensuring these offensive toolkits remain importable by subsequent Python processes. The mhddos toolkit is staged under /tmp and executed via python3 start.py, providing immediate code execution on the installer's host at npm install time.
Additionally, the script collects system information including id and hostname output, along with toolkit-verification results, base64-encodes this data, and sends it to https://jasabersama.id/portfolio-data.php via an HTTPS GET request with the payload in a query parameter. TLS verification is disabled for this exfiltration as well.
The incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-13883).
Indicators of compromise
- Packages
- @years18/n8n-nodes-utils-helper-y
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years18/n8n-nodes-utils-helper-y from all systems
- Audit Python site-packages directories for unexpected impacket and pyroxy-full installations and remove them
- Check /tmp for mhddos toolkit remnants and remove
- Review system logs and network traffic for connections to jasabersama.id
- Regenerate credentials and SSH keys on any affected systems
- Monitor for lateral movement or use of impacket/PyRoxy toolkits on the network
- Verify npm package integrity and use npm audit to identify other potentially compromised dependencies
Sources
- GitHub Advisory GHSA-9mh2-cr4c-7jp5 · GitHub Advisory Database
Cite this entry
"Malicious code in @years18/n8n-nodes-utils-helper-y (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years18-n8n-nodes-utils-helper-y-npm-18hnkq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @years19/n8n-nodes-utils-helper-b (npm)
The npm package @years19/n8n-nodes-utils-helper-b contained malicious code disguised as an n8n workflow utility. The postinstall hook executed reconnaissance, downloaded and extracted a Python tarball with TLS verification disabled, and exfiltrated system information to an attacker-controlled domain.
npmPyPICompromised package - resolvedcritical
Malicious code in @years19/n8n-nodes-utils-helper-c (npm)
The npm package @years19/n8n-nodes-utils-helper-c contained a malicious postinstall script that downloads a trojanized Python multidict module from an attacker-controlled server and injects it into the system's Python site-packages directory, enabling arbitrary code execution on any subsequent Python invocation.
npmPyPICompromised packageMalicious commit - containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting - containedcritical
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering stealer malware designed to harvest credentials from developers and application users.
npmPyPITyposquattingCompromised package