Malicious code in @years19/n8n-nodes-utils-helper-f (npm)
The npm package @years19/n8n-nodes-utils-helper-f contained malicious code that exfiltrates host identity and environment data to an attacker-controlled server during installation and on require. The package mimics legitimate n8n community node naming conventions.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious package via npm
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-fMalicious npm package masquerading as n8n community node
The package @years19/n8n-nodes-utils-helper-f was published to npm containing a postinstall script (callback.js) that executes on installation. The script collects sensitive host information including the output of the id command, hostname, Python user-site paths, and system uptime.
The collected data is base64-encoded and sent to https://jasabersama.id/portfolio-data.php with TLS verification disabled. The request includes a hardcoded key parameter (k=S7k9xQ2mZj) and a command channel parameter (c=) containing base64-encoded commands, indicating a beacon/check-in mechanism for attacker control.
The package masquerades as a legitimate n8n community node by mimicking the naming convention (n8n-nodes-*) and including a stub node file (PwnNode.node.js), while the main entry point (index.js) is identical to the exfiltration script. This ensures malicious code executes both during npm install and when the package is required.
The package was identified by Amazon Inspector and credited to the OpenSSF malicious packages database.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-f
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-f from all systems
- Audit npm install logs to identify when the package was installed
- Assume compromise of any system that installed this package; review for unauthorized access and data exfiltration
- Rotate credentials and SSH keys on affected systems
- Monitor network traffic to jasabersama.id for any outbound connections
- Review system logs for suspicious activity during and after the installation window
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-cjrw-r5jf-jg9m · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-f (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-f-npm-urtlfp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting