npm: Coordinated Drop of 17 Malicious Packages, Including 'n8n-nodes-' Family, Hits Registry
On July 22, 2026, 17 malicious packages, including a family impersonating `n8n-nodes-` utilities, were disclosed on npm within a tight 16-minute window.
Key findings
- 17 malicious npm packages disclosed in a coordinated 16-minute window on July 22, 2026.
- A family of packages used the
n8n-nodes-prefix, impersonating legitimate utilities. - Other packages included typosquats like
habingeerandhabinger, and theencryptstringfamily. - IOCs suggest attempts to exfiltrate sensitive files, credentials, and execute commands.
- Affected systems should be considered fully compromised; immediate credential rotation is advised.
On July 22, 2026, 17 malicious packages were disclosed on the npm registry within a tight 16-minute window, from 20:24 UTC to 20:40 UTC. This coordinated burst included a distinct family of packages leveraging the n8n-nodes- prefix, alongside other ad-hoc malicious modules, all flagged and removed from the registry on the same day.
The coordinated nature of this disclosure is evident in the rapid succession of advisories and the clear naming patterns observed across several packages. A significant portion of the burst, comprising seven packages, adopted the n8n-nodes- prefix, likely attempting to impersonate legitimate utility modules related to the n8n workflow automation platform. Examples include n8n-nodes-net-utils, n8n-nodes-pwn, n8n-nodes-quick-utils, and n8n-nodes-task-runner. Another cluster of packages, encrypt-string-ttak, encryptstringadmin, and encryptstringadmincore, suggests a related theme or actor. Furthermore, the packages habinger and habingeer appear to be typosquats of each other, indicating an attempt to capitalize on common misspellings. The remaining packages, such as application-util, web3-terminal, and date-format-utils-xz, appear to be more ad-hoc, but their simultaneous disclosure within the same narrow window strongly points to a single, coordinated malicious campaign.
While specific behavioral findings for each package were not detailed, the list of extracted Indicators of Compromise (IOCs) strongly suggests that these malicious packages were designed to exfiltrate sensitive information and potentially gain further control over compromised systems. The IOCs include references to critical system files and credentials such as accesstokens.json, id.json, config.toml, and kubelet.conf, indicating a focus on harvesting authentication tokens and configuration data. The presence of docker.sock points to attempts to interact with Docker daemon, potentially for container escape or further system compromise. Furthermore, cp.spawn suggests the execution of arbitrary commands, a common tactic for establishing persistence or escalating privileges. The mention of metadata.google.internal could indicate attempts to access cloud instance metadata, a valuable source of credentials and system information in cloud environments. These findings collectively paint a picture of malware aiming for broad system compromise and data exfiltration.
The compromise posed by these packages is severe. Any system that installed an affected version of these malicious modules should be considered fully compromised. Developers and organizations are strongly advised to treat such an incident with the highest priority, assuming that all secrets, credentials, and sensitive data accessible from the compromised environment may have been exfiltrated. Immediate action, including the rotation of all affected credentials and tokens from a separate, clean machine, is critical to mitigate further damage.
To detect and respond to this threat, developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious package names. If found, these packages must be removed, and a thorough security review of the affected system should be conducted. Given the nature of the potential compromise, it is imperative to rotate all credentials, API keys, and tokens that were present or accessible on the compromised machine. Additionally, administrators should review npm token logs for any unauthorized publish events or suspicious activity. A representative list of package names to check for includes:
application-utilweb3-terminalhabingern8n-nodes-pwnencryptstringadmindate-format-utils-xz
This burst of 17 malicious npm packages, disclosed within minutes of each other, underscores the persistent threat of supply chain attacks targeting open-source ecosystems. The use of both targeted naming conventions, like the n8n-nodes- prefix, and ad-hoc typosquats demonstrates a multi-pronged approach by attackers to maximize their reach. Such rapid, coordinated drops highlight the challenges faced by registry maintainers and security researchers in identifying and mitigating threats, emphasizing the need for continuous vigilance and robust automated detection mechanisms to protect the software supply chain.