Malicious Code Injection in n8n-nodes-moonlet-helpers Package
Summary
MAL-2026-17176: Malicious code in n8n-nodes-moonlet-helpers (npm). Affects n8n-nodes-moonlet-helpers versions 1.0.0 – 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The n8n-nodes-moonlet-helpers package is designed to provide helper nodes for the n8n workflow automation tool. It is intended to facilitate various integrations and functionalities within n8n. However, this package has been found to contain malicious code that compromises the security of systems using it.
Vulnerability Detail
The vulnerability originates from the package's post-installation script, which executes a malicious payload downloaded from a disguised URL. Upon installation, the package runs a script that fetches an executable file from an HTTPS endpoint, writes it to a temporary location, and executes it with full user privileges. This behavior allows an attacker to run arbitrary code on the installer's system, posing significant security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall n8n-nodes-moonlet-helpersIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the n8n-nodes-moonlet-helpers package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The n8n-nodes-moonlet-helpers package contains a serious vulnerability that allows for the execution of malicious code. Users are advised to update to a patched version or avoid using the package until a fix is available. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for n8n-nodes-moonlet-helpers →
FAQ
It is a package designed to provide helper nodes for the n8n workflow automation tool.
The vulnerability allows an attacker to execute arbitrary code on your system, potentially leading to data breaches or system compromise.
Immediately uninstall the package and monitor your system for any unusual activity. Consider updating to a patched version if available.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Vulert is a tool that uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software, helping developers maintain secure applications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
