Malicious code in @years19/n8n-nodes-utils-helper-a (npm)
The npm package @years19/n8n-nodes-utils-helper-a contained malicious code that executed a postinstall script to download and execute attack tooling, write Python packages to the system, and exfiltrate system information to an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious npm package @years19/n8n-nodes-utils-helper-a
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-aMalicious npm package
The package @years19/n8n-nodes-utils-helper-a was published to npm with malicious intent. While it advertised itself as an n8n utility helper and included a trivial stub node, the actual attack payload was delivered via a postinstall lifecycle script.\n\nUpon installation, the postinstall script disabled TLS verification and fetched a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz, extracting it into the user's Python site-packages directory. The archive contained attack tools including PyRoxy, impacket, and mhddos, which were then executed via /tmp/mhddos/start.py.\n\nThe postinstall script also executed reconnaissance commands (id and hostname) on the installer's machine, base64-encoded the output along with results from the dropped payload, and transmitted this information to https://jasabersama.id/portfolio-data.php via an HTTPS request that smuggled a shell command in the path.\n\nThis attack resulted in arbitrary code execution on the installer's host, installation of attacker-controlled Python packages, and exfiltration of system identity and execution results to the attacker's infrastructure.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-a
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-a from all systems
- Audit Python site-packages directories for unexpected packages (PyRoxy, impacket, mhddos)
- Review system logs and network traffic for connections to jasabersama.id
- Regenerate credentials and SSH keys on affected systems
- Scan systems for persistence mechanisms or additional malware
- Review npm audit logs to identify when the package was installed
- Block the attacker-controlled domains (jasabersama.id) at the network level
Sources
- GitHub Advisory GHSA-3wg8-34g2-8xh6 · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-a (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-a-npm-pr5p4u
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit