Malicious code in @years20/n8n-nodes-utils-helper-c (npm)
The npm package @years20/n8n-nodes-utils-helper-c contained malicious postinstall code that exfiltrates system information (user ID, hostname, SSH public keys) to an attacker-controlled server and attempts authenticated SSH lateral movement using an embedded private key.
- Disclosed
- Last updated
- Blast radius
- Any system installing @years20/n8n-nodes-utils-helper-c from npm; lateral movement risk to SSH-accessible hosts on the installer's network.
- Ecosystems
- Attack vectors
- Affected entities
- @years20/n8n-nodes-utils-helper-cMalicious npm package impersonating n8n utility
The npm package @years20/n8n-nodes-utils-helper-c was published with malicious code in its postinstall hook. Upon installation, the package executes system reconnaissance commands (id, hostname), reads the SSH public key from /etc/ssh/ssh_host_ed25519_key.pub, detects WSL environments, and base64-encodes the collected data.
The exfiltrated data is sent via HTTPS GET request to jasabersama.id/portfolio-data.php with TLS verification disabled. The payload is framed as a shell command, indicating the attacker maintains an RCE handler on the server side. The campaign is explicitly labeled as targeting n8n.
Additionally, the postinstall script decodes an embedded base64-encoded OpenSSH ed25519 private key, writes it to /tmp/pk with restrictive permissions (mode 0600), and attempts authenticated SSH connections to localhost on ports 22495 and 22 using common usernames (devuser, ubuntu, runner, node, root, chris, user). Successful authentication would allow the attacker to execute arbitrary commands on the installer's host.
The package was identified and reported by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @years20/n8n-nodes-utils-helper-c
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years20/n8n-nodes-utils-helper-c from all systems.
- Audit npm package.json and lock files for any presence of this package or similar typosquatting variants.
- Review system logs and SSH logs on any host where this package was installed for signs of unauthorized access or lateral movement attempts.
- Rotate SSH keys and credentials on affected systems, particularly if SSH access on non-standard ports (22495) or to localhost was detected.
- Monitor network traffic for connections to jasabersama.id and block the domain at the firewall level.
- Check for presence of `/tmp/pk` or `/tmp/n8n_rce_result.txt` on affected systems as indicators of successful exploitation.
- Use npm audit and supply chain security tools to detect and prevent installation of malicious or typosquatted packages.
- Verify the legitimacy of n8n-related packages; the official n8n organization is distinct from @years20.
Sources
- GitHub Advisory GHSA-839j-vj89-7mq3 · GitHub Advisory Database
Cite this entry
"Malicious code in @years20/n8n-nodes-utils-helper-c (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years20-n8n-nodes-utils-helper-c-npm-bzabrq
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit