Am I affected by Malicious code in n8n-nodes-data-transformer-utils (npm)? What should I do?
The npm package n8n-nodes-data-transformer-utils version 1.0.0 contains malicious code.
Affected: n8n-nodes-data-transformer-utils 1.0.0. Fixed in: no fix reported yet. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/ghsa-w3qc-pff7-wmpv-n8n-nodes-data-transformer-utils-npm-package (opens external site)
1 answer
Am I affected? Affected: n8n-nodes-data-transformer-utils 1.0.0. Fixed in: no fix reported yet.
- Check your version: run
npm ls n8n-nodes-data-transformer-utils. Versions = 1.0.0 of n8n-nodes-data-transformer-utils are affected.
What to do now
- Remove the package if it is installed: run
npm uninstall n8n-nodes-data-transformer-utils. - No fixed version is available yet, so there is no upgrade to move to.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-w3qc-pff7-wmpv (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/09/ghsa-w3qc-pff7-wmpv-n8n-nodes-data-transformer-utils-npm-package (opens external site)
Did this work for you?- Check your version: run