Malicious code in @years19/n8n-nodes-utils-helper-c (npm)
The npm package @years19/n8n-nodes-utils-helper-c contained a malicious postinstall script that downloads a trojanized Python multidict module from an attacker-controlled server and injects it into the system's Python site-packages directory, enabling arbitrary code execution on any subsequent Python invocation.
- Disclosed
- Last updated
- Blast radius
- Any system that installed the malicious npm package and ran npm install, with Python installed.
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-cMalicious npm package with postinstall script that downloads and executes arbitrary Python code
The npm package @years19/n8n-nodes-utils-helper-c, which mimics the name of a legitimate n8n community node, contained malicious code in its postinstall script (callback.js). Upon installation, the script resolves the user's Python site-packages directory and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS certificate verification disabled.
The downloaded archive is extracted directly into site-packages, making its contents auto-loadable as the Python module multidict. This allows the attacker to achieve arbitrary code execution on any subsequent python3 invocation on the affected system.
Additionally, the postinstall script collects system information by running id and hostname, probes for offensive security tools (PyRoxy, impacket, mhddos), and executes /tmp/mhddos/start.py if present. The collected data is base64-encoded and sent as a GET query parameter to https://jasabersama.id/portfolio-data.php, also with certificate verification disabled.
The attack leverages typosquatting (mimicking a legitimate package name) and supply chain compromise to deliver malicious code that bridges npm and Python ecosystems, giving the attacker persistent code execution capabilities.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-c
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-c from all systems
- Audit Python site-packages directories for unexpected or suspicious modules, particularly 'multidict'
- Review system logs for suspicious Python imports or execution of /tmp/mhddos/start.py
- Check for outbound connections to jasabersama.id and block at network level
- Regenerate credentials and review access logs on affected systems
- Use npm audit to identify and remove other malicious packages from the same publisher
- Implement package verification and pinning in dependency management to prevent similar attacks
Sources
- GitHub Advisory GHSA-587g-69rv-xpg7 · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-c (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-c-npm-1m1y4d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in ranux-pro (npm)
The npm package ranux-pro contained malicious code disguised as a network socket library. The package shipped a multi-tenant WhatsApp bot with obfuscated code and a mutable dependency override pointing to a personal GitHub account, allowing attackers to execute arbitrary code at install and runtime.
npmCompromised packageMalicious commit - containedcritical
Malicious code in dxrs-dos (npm)
The npm package dxrs-dos is an openly-advertised DDoS/booter toolkit that executes malicious code on module load. It uses an unpinned dependency (deathoffather-project) for arbitrary code execution and extracts a password-protected PHP C2 panel archive into the caller's working directory.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in libas-signal (npm)
libas-signal, an npm package masquerading as a Signal Protocol library, contained malicious code that on require() injects a modified version of @whiskeysockets/baileys' Socket/newsletter.js to silently issue WhatsApp newsletter follow commands using the installer's authenticated session.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wizloft/harness-validation (npm)
The npm package @wizloft/harness-validation and sibling packages contain obfuscated malicious code that executes on import. The payload implements a blockchain-based dead-drop mechanism using Ethereum transactions to fetch and execute arbitrary code, allowing the attacker to remotely update the delivered payload.
npmCompromised packageMalicious commit