Malicious code in @years19/n8n-nodes-utils-helper-b (npm)
The npm package @years19/n8n-nodes-utils-helper-b contained malicious code disguised as an n8n workflow utility. The postinstall hook executed reconnaissance, downloaded and extracted a Python tarball with TLS verification disabled, and exfiltrated system information to an attacker-controlled domain.
- Disclosed
- Last updated
- Blast radius
- Any user who installed @years19/n8n-nodes-utils-helper-b; secondary impact on Python environments via site-packages injection.
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-bnpm package containing malicious postinstall hook
The npm package @years19/n8n-nodes-utils-helper-b was published with malicious intent, advertising itself as a utility helper for n8n workflow automation. The actual n8n node shipped (nodes/PwnNode.node.js) was a non-functional 213-byte stub, serving as cover for the true payload.
Upon installation, a postinstall hook (duplicated in index.js) executed reconnaissance commands (id and hostname), then downloaded a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS verification disabled (rejectUnauthorized:false) and extracted it into the user's Python site-packages directory. This granted the attacker code execution on any subsequent Python import.
The malicious code then probed the host for offensive security tools (PyRoxy, impacket, MHDDoS start.py), base64-encoded the reconnaissance output along with system identifiers and site-packages path, and exfiltrated this data as a query parameter to https://jasabersama.id/portfolio-data.php.
This incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-b
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-b from all affected systems
- Audit Python site-packages directory for unexpected or suspicious packages, particularly multidict.tgz contents
- Review system logs for suspicious postinstall hook execution and outbound connections to jasabersama.id
- Regenerate credentials and API keys on affected systems
- Monitor for indicators of compromise from the reconnaissance data (id, hostname, tool presence)
- Block connections to jasabersama.id at the network level
Sources
- GitHub Advisory GHSA-4687-m6w5-v3h4 · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-b (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-b-npm-twocui
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @years19/n8n-nodes-utils-helper-c (npm)
The npm package @years19/n8n-nodes-utils-helper-c contained a malicious postinstall script that downloads a trojanized Python multidict module from an attacker-controlled server and injects it into the system's Python site-packages directory, enabling arbitrary code execution on any subsequent Python invocation.
npmPyPICompromised packageMalicious commit - containedcritical
Malicious code in @years19/n8n-nodes-utils-helper-d (npm)
The npm package @years19/n8n-nodes-utils-helper-d contained malicious code that downloads and executes a Python DDoS/offensive-tooling dropper on installation. The package impersonates a legitimate n8n community node but performs unauthorized system reconnaissance and beacons host identity to an attacker-controlled endpoint.
npmPyPICompromised packageTyposquatting - resolvedcritical
Malicious code in @years18/n8n-nodes-utils-helper-y (npm)
The npm package @years18/n8n-nodes-utils-helper-y contained malicious code in its postinstall hook that downloads and executes attacker-controlled Python toolkits (mhddos, pyroxy-full, impacket), persists them in the user's Python site-packages, and exfiltrates host information to an attacker-controlled endpoint. Installation triggers immediate code execution and establishes persistence.
npmPyPICompromised package - containedcritical
Fake Paysafe, Skrill SDKs on NPM and PyPi steal credentials
Malicious packages impersonating Paysafe, Skrill, and Neteller SDKs were published on npm and PyPI, delivering stealer malware designed to harvest credentials from developers and application users.
npmPyPITyposquattingCompromised package