Malicious code in @years20/n8n-nodes-utils-helper-e (npm)
The npm package @years20/n8n-nodes-utils-helper-e contained malicious code that executed on install and module load, exfiltrating system information and SSH keys to a remote C2 server and attempting SSH brute-force attacks using a bundled private key.
- Disclosed
- Last updated
- Blast radius
- Any developer or system installing the malicious npm package @years20/n8n-nodes-utils-helper-e
- Ecosystems
- Attack vectors
- Affected entities
- @years20/n8n-nodes-utils-helper-eMalicious npm package impersonating n8n community-nodes helper
The npm package @years20/n8n-nodes-utils-helper-e was published with malicious postinstall and main entry-point scripts designed to execute automatically on npm install and module load. The malicious code (callback.js and index.js) performed system reconnaissance including running id, hostname, and WSL detection commands.
The payload exfiltrated sensitive host information by reading the SSH public key fingerprint from /etc/ssh/ssh_host_ed25519_key.pub, base64-encoding the collected data, and sending it via HTTPS GET requests to jasabersama.id/portfolio-data.php with TLS verification disabled. The C2 endpoint path /portfolio-data.php?k=S7k9xQ2mZj&c= indicates dual-use infrastructure for both data exfiltration and remote command execution.
Additionally, the package decoded a bundled OpenSSH ed25519 private key to /tmp/pk and performed SSH brute-force attacks against localhost on ports 22495 and 22, attempting login as multiple common usernames (devuser, ubuntu, runner, node, root, chris, user). Any successful login would execute id; hostname commands, enabling further system compromise.
The malicious package was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- @years20/n8n-nodes-utils-helper-e
- Domains
- jasabersama.id
Remediation
- Immediately uninstall @years20/n8n-nodes-utils-helper-e from all systems
- Audit npm install logs and package-lock.json files to identify affected installations
- Revoke or rotate SSH keys on any systems that may have installed this package
- Review system logs for suspicious SSH login attempts and data exfiltration to jasabersama.id
- Scan systems for the presence of /tmp/pk and any unauthorized SSH key material
- Update npm to the latest version and use `npm audit` to detect similar malicious packages
- Consider using npm package signing verification and private registry mirrors to prevent installation of typosquatted or malicious packages
Sources
- GitHub Advisory GHSA-g8c3-g2g7-395c · GitHub Advisory Database
Cite this entry
"Malicious code in @years20/n8n-nodes-utils-helper-e (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-years20-n8n-nodes-utils-helper-e-npm-1orzab
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit