Malicious code in @years19/n8n-nodes-utils-helper-s (npm)
The npm package @years19/n8n-nodes-utils-helper-s contains malicious code that performs host reconnaissance, exfiltrates system identity data, and launches a DDoS bot targeting IP 103.118.252.21. The malicious behavior is triggered both via postinstall script and when the module is required, bypassing --ignore-scripts protections.
- Disclosed
- Last updated
- Blast radius
- Any system installing @years19/n8n-nodes-utils-helper-s; affected machines become DDoS bots and leak host identity data.
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-sMalicious npm package masquerading as n8n utility node
The npm package @years19/n8n-nodes-utils-helper-s was published with embedded malicious code disguised as an n8n utility node. The package contains no legitimate functionality.\n\nThe malicious behavior includes: (1) a postinstall script that writes /tmp/attack.py—a Python UDP/TCP flooder targeting hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds—and launches it via nohup; (2) identical dropper code in index.js (the declared package main), which re-triggers the attack when the module is require()d, even if installation used --ignore-scripts; (3) host reconnaissance collecting installer identity (id, hostname, process listing, /proc/loadavg), base64-encoding the data, and exfiltrating it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false).\n\nAny system installing this package becomes both a reconnaissance target and an unwitting DDoS bot. The attack persists across installation flags designed to prevent script execution.\n\nThe incident was identified by OpenSSF's malicious-packages project and reported via GitHub Advisory GHSA-mmxq-3q24-8xr3.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-s
- Domains
- jasabersama.id
- IPs
- 103.118.252.21
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-s from all systems
- Kill any running /tmp/attack.py processes and remove the file
- Audit npm package.json and lock files for this dependency across all projects
- Review system logs and network traffic for connections to jasabersama.id and DDoS activity to 103.118.252.21
- Rotate credentials and review system access logs on affected machines
- Use npm audit to identify and remove the malicious package from dependency trees
- Consider blocking the package name and publisher account at the registry level
Sources
- GitHub Advisory GHSA-mmxq-3q24-8xr3 · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-s (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-s-npm-1depjo
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit