OpenSSF/OSV advisory MAL-2026-13849 confirms this npm version as malicious. On `npm install`, the declared postinstall script `node callback.js` performs two hostile actions against the installer. First, it downloads a tarball from `https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz` with TLS verification disabled (`rejectUnauthorized:false`), extracts it under /tmp, pip-installs its requirements with `--break-system-packages`, and executes `python3 start.py` — the archive name...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-c (npm)
Details
On `npm install`, the declared postinstall script `node callback.js` performs two hostile actions against the installer. First, it downloads a tarball from `https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz` with TLS verification disabled (`rejectUnauthorized:false`), extracts it under /tmp, pip-installs its requirements with `--break-system-packages`, and executes `python3 start.py` — the archive name and structure correspond to the MHDDoS attack tool. Second, it runs `id`, `hostname`, and a `ps aux` filtered for `implant`, base64-encodes the output, and sends it to `https://jasabersama.id/portfolio-data.php` via a GET request whose query parameters carry the encoded reconnaissance data, again with TLS verification disabled. Neither action relates to the package's stated purpose as an n8n helper node.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-c@1.0.0 as malicious (MAL-2026-13849): Malicious code in @years18/n8n-nodes-utils-helper-c (npm)