OpenSSF/OSV advisory MAL-2026-13859 confirms this npm version as malicious. The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-o (npm)
Details
The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of Python DDoS-support dependencies via pip with --break-system-packages, then executes `python3 start.py` from the extracted MHDDoS archive. The same script runs `id` and `hostname`, base64-encodes the output along with install-progress markers, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. The declared n8n utility purpose is a cover story for the install-time payload.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-o@1.0.0 as malicious (MAL-2026-13859): Malicious code in @years18/n8n-nodes-utils-helper-o (npm)