OpenSSF/OSV advisory MAL-2026-13848 confirms this npm version as malicious. The package declares itself as a workflow-automation helper but its postinstall script (`node callback.js`) fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over a TLS-verification-disabled HTTPS connection, extracts it to /tmp/mhddos, installs its Python requirements, and executes `python3 start.py`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-b (npm)
Details
The package declares itself as a workflow-automation helper but its postinstall script (`node callback.js`) fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over a TLS-verification-disabled HTTPS connection, extracts it to /tmp/mhddos, installs its Python requirements, and executes `python3 start.py`. In parallel, the script collects installer host identity (`id`, `hostname`) and the output of the tar/pip/execute steps, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate validation disabled). The remote path is staged under a decoy `/assets/cache/.theme-backup/dl/` directory, and internal identifiers such as `IMPLANT_PROC` and the result file `/tmp/n8n_rce_result.txt` correspond to implant behavior rather than a helper library. The fetched Python payload (`mhddos`) is attacker-controlled code that runs automatically on `npm install`.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-b@1.0.0 as malicious (MAL-2026-13848): Malicious code in @years18/n8n-nodes-utils-helper-b (npm)