Malicious code in @years19/n8n-nodes-utils-helper-p (npm)
The npm package @years19/n8n-nodes-utils-helper-p contained malicious code that downloads DDoS tools, launches botnet processes, and establishes a command-and-control channel. The payload executes on both npm install (postinstall hook) and on require, defeating --ignore-scripts protections.
- Disclosed
- Last updated
- Blast radius
- Any npm user installing @years19/n8n-nodes-utils-helper-p; systems running n8n with this community node loaded; targets of DDoS attacks launched from compromised hosts.
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-pMalicious npm package containing DDoS botnet payload
The npm package @years19/n8n-nodes-utils-helper-p was published with embedded malicious code designed to establish a DDoS botnet on infected systems. Upon installation and/or when the package is required (imported), the payload fetches multiple tarballs (mhddos, pyroxy-full, impacket, multidict) from jasabersama.id over HTTPS with TLS verification disabled, extracts them to /tmp and Python site-packages, and launches three background Python processes running mhddos attacks against the hardcoded target 103.118.252.21 on UDP:80, TCP:443, and GET:80 for 600 seconds.\n\nThe malicious code is present in both callback.js and index.js (byte-identical), ensuring execution occurs both during the postinstall lifecycle hook and when the package is imported by n8n, defeating npm's --ignore-scripts protection. The payload collects system information (id, hostname, attack-process status), base64-encodes it, and sends it via GET request to https://jasabersama.id/portfolio-data.php with parameters k= and c=, where c= carries shell commands, establishing a reporting and command-execution channel to the attacker.\n\nThis incident was identified and credited to the OpenSSF malicious-packages repository. The package has been removed from npm and the incident is considered resolved.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-p
- Domains
- jasabersama.id
- IPs
- 103.118.252.21
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-p from all systems
- Audit npm install logs and package-lock.json for any installation of this package
- Kill any running Python processes (mhddos, pyroxy-full) on affected systems
- Review firewall and network logs for outbound connections to jasabersama.id and DDoS traffic to 103.118.252.21
- Reinstall n8n and all dependencies from a clean state after removing the malicious package
- Monitor for signs of compromise or command execution via the C2 channel
- Use npm audit to check for other malicious packages in your dependency tree
Sources
- GitHub Advisory GHSA-jf32-2mcv-8vf7 · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-p (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-p-npm-cdu3xf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit