Malicious code in @years19/n8n-nodes-utils-helper-w (npm)
The npm package @years19/n8n-nodes-utils-helper-w contains malicious code in its postinstall and main entry points that launches a DDoS attack and exfiltrates system information. The package was identified by Amazon Inspector and OpenSSF as containing intentional malware with no legitimate functionality.
- Disclosed
- Last updated
- Blast radius
- Any system installing @years19/n8n-nodes-utils-helper-w or loading it as an n8n community node
- Ecosystems
- Attack vectors
- Affected entities
- @years19/n8n-nodes-utils-helper-wMalicious npm package masquerading as n8n utility helper
The npm package @years19/n8n-nodes-utils-helper-w was published with malicious code embedded in both its postinstall hook (callback.js) and main entry point (index.js). The code is byte-identical in both locations, ensuring execution occurs both during installation and when the package is loaded by n8n.
The malicious payload performs two primary actions: (1) it writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP address 103.118.252.21 for 900 seconds and executes it via nohup, and (2) it collects sensitive system information including shell ID, hostname, /proc/loadavg, and process listings, base64-encodes the data, and sends it to https://jasabersama.id/portfolio-data.php with TLS verification disabled.
The package falsely presents itself as an n8n utility helper but contains no functional node code matching that purpose. Both malicious triggers fire automatically: the postinstall runs on npm install, and the main module executes again when n8n loads the community node via require().
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @years19/n8n-nodes-utils-helper-w
- Domains
- jasabersama.id
- IPs
- 103.118.252.21
Remediation
- Immediately uninstall @years19/n8n-nodes-utils-helper-w from all systems
- Audit systems that installed this package for signs of DDoS activity and unauthorized network connections to 103.118.252.21
- Review system logs and process listings for execution of /tmp/attack2.py or suspicious Python processes
- Check for data exfiltration to jasabersama.id or similar domains
- Verify n8n installations do not have this package listed as a community node
- Use npm audit to identify any transitive dependencies on this package
- Monitor for similar typosquatting or impersonation packages targeting n8n utilities
Sources
- GitHub Advisory GHSA-f4v6-35w9-c5jm · GitHub Advisory Database
Cite this entry
"Malicious code in @years19/n8n-nodes-utils-helper-w (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years19-n8n-nodes-utils-helper-w-npm-1xtdod
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit