OpenSSF/OSV advisory MAL-2026-13860 confirms this npm version as malicious. Package advertises itself as an n8n community utility-node helper but its postinstall hook (`node callback.js`) fetches two tarballs from jasabersama.id (mhddos.tgz and pyroxy.tgz) with TLS verification disabled, extracts them to /tmp and the Python user site-packages, installs network-attack Python dependencies via `pip install --break-system-packages`, and runs `python3 start.py` on the extracted MHDDoS code —...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-p (npm)
Details
Package advertises itself as an n8n community utility-node helper but its postinstall hook (`node callback.js`) fetches two tarballs from jasabersama.id (mhddos.tgz and pyroxy.tgz) with TLS verification disabled, extracts them to /tmp and the Python user site-packages, installs network-attack Python dependencies via `pip install --break-system-packages`, and runs `python3 start.py` on the extracted MHDDoS code — turning the installer's host into a DDoS attack node. The same postinstall captures `id` and `hostname` output plus install progress, base64-encodes it, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate verification disabled). The shipped node file is named `nodes/PwnNode.node.js`, contradicting the package's stated benign purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-p@1.0.0 as malicious (MAL-2026-13860): Malicious code in @years18/n8n-nodes-utils-helper-p (npm)