npm: 11 Malicious Packages Impersonating 'n8n-nodes' Utilities Disclosed in Under a Minute
Eleven malicious npm packages, many impersonating `n8n-nodes` utilities, were disclosed within a single minute on September 25, 2026, posing critical supply chain risks.
Key findings
- Eleven malicious npm packages were disclosed within a single minute on September 25, 2026.
- Multiple packages impersonated
n8n-nodesutilities, indicating a targeted campaign. - Several modules, like
secure-env3and@alphaspace/core, were newly published just hours before disclosure. - All packages were assigned a 'Critical' severity, implying full system compromise upon installation.
- Indicators of compromise suggest capabilities for file system manipulation and arbitrary code execution.
On September 25, 2026, eleven malicious packages were disclosed on the npm registry within a single minute, indicating a highly coordinated supply chain attack. This burst featured several packages impersonating legitimate n8n-nodes utilities, alongside other newly published malicious modules like secure-env3 and @alphaspace/core that were registered just hours before their disclosure.
The coordinated nature of this burst is evident in the rapid disclosure window and the clear naming patterns observed across several packages. A significant portion of the malicious modules, including n8n-nodes-moonlet-utils, n8n-nodes-flowstats, and n8n-nodes-moonlet-helpers, leverage the n8n-nodes- prefix. This suggests an attempt to impersonate or typosquat packages related to the popular n8n workflow automation platform. Additionally, pairs like chromatitle and chromatitle-js, as well as agency-test-exercise and agency-testts, point to either a shared campaign theme or direct typosquatting efforts. The packages secure-env3 and better-dotenv3 also appear to be typosquats of common environment variable management libraries. Notably, secure-env3 and better-dotenv3 were first published just 14 hours before their disclosure, and @alphaspace/core only 9 hours prior, indicating fresh malicious uploads rather than account takeovers of long-standing projects.
While detailed behavioral findings for each specific package were not provided, the consistent 'Critical' severity ratings across all eleven advisories, coupled with the presence of suspicious file system operations and command execution indicators, paint a clear picture of their malicious intent. The extracted indicators of compromise (IOCs) include references to file system operations like fs.chmodsync, fs.createwritestream, fs.mkdirsync, fs.unlinksync, and command execution via cmd.exe. These functions are commonly abused by malware to manipulate files, create directories, delete data, and execute arbitrary commands on the compromised system. Such capabilities enable attackers to establish persistence, exfiltrate sensitive data, or deploy further payloads.
The uniform 'Critical' severity assigned to all disclosed packages underscores the severe risk they pose to developers and their projects. Installation of any of these malicious versions should lead to the immediate assumption of a full system compromise. Attackers gaining control through such packages can access sensitive information, inject backdoors, or pivot to other systems within the development environment or CI/CD pipelines. It is imperative that any affected systems are treated as compromised, and all credentials, API keys, and tokens that may have been exposed are rotated without delay, ideally from a separate, secure machine.
Developers should immediately audit their project dependencies by checking package-lock.json or yarn.lock files for the presence of any of the following malicious package names:
secure-env3wallet-connect-adaptern8n-nodes-moonlet-utilsbetter-dotenv3n8n-nodes-flowstatschromatitle@alphaspace/core
If any of these packages are found, they must be removed, and all associated credentials, including npm tokens, Git credentials, and cloud provider keys, should be considered compromised and rotated. Furthermore, organizations should review their npm token logs for any unauthorized publish events that might indicate a broader compromise.
This rapid, coordinated disclosure highlights the ongoing threat of supply chain attacks targeting popular package ecosystems like npm. The use of both typosquatting and impersonation of well-known libraries or frameworks remains a prevalent tactic for attackers to distribute malware. The swift identification and disclosure of these packages by security researchers and the npm security team demonstrate the critical importance of continuous monitoring and rapid response in safeguarding the software supply chain. Such bursts, while concerning, also serve as a reminder for developers to exercise vigilance when adding new dependencies and to scrutinize package names and maintainer information.