Malicious code in @years19/n8n-nodes-utils-helper-l (npm)
The npm package @years19/n8n-nodes-utils-helper-l contained malicious code that executes on install and require, downloading DDoS tools and launching attacks against a remote IP while exfiltrating system information.
- Disclosed
- Last updated
- Blast radius
- Any user or system installing or requiring the @years19/n8n-nodes-utils-helper-l package
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-lMalicious npm package
The npm package @years19/n8n-nodes-utils-helper-l was published with embedded malicious code in its postinstall script and main entrypoint (index.js). The payload executes both during npm install and whenever the package is imported via require() or import statements.\n\nThe malicious code downloads four tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled. These are extracted into /tmp and the user's Python site-packages directory, then spawned as backgrounded python3 processes running MHDDoS UDP/TCP/GET flood attacks against IP 103.118.252.21.\n\nIn parallel, the code collects system information via id and hostname commands, base64-encodes the output, and sends it via HTTPS GET requests to https://jasabersama.id/portfolio-data.php using a c= parameter as a remote-command handback channel, establishing a command-and-control mechanism.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-13895).
Indicators of compromise
- Domains
- jasabersama.id
- IPs
- 103.118.252.21
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-l from all systems
- Audit npm install logs and package-lock.json files to identify affected installations
- Scan systems for unexpected Python processes or DDoS tools in /tmp and site-packages directories
- Review network logs for outbound connections to jasabersama.id and 103.118.252.21
- Rotate credentials and review system access logs on affected machines
- Block domains jasabersama.id and IP 103.118.252.21 at the network perimeter
- Use npm audit to check for this package in dependency trees
Sources
- GitHub Advisory GHSA-g9vj-cx2p-wwwh · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-l (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-l-npm-1pcjmc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit