OpenSSF/OSV advisory MAL-2026-13862 confirms this npm version as malicious. @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on `npm install`, downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy-full.tgz over TLS with certificate verification disabled and extracts it into the installer's Python site-packages directory, then verifies the drop by executing `python3 start.py` from /tmp/mhddos...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-r (npm)
Details
@years18/n8n-nodes-utils-helper-r ships a postinstall script that, on `npm install`, downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy-full.tgz over TLS with certificate verification disabled and extracts it into the installer's Python site-packages directory, then verifies the drop by executing `python3 start.py` from /tmp/mhddos. The dropped payload is the PyRoxy / MHDDOS DDoS attack framework. The same postinstall collects the output of `id` and `hostname`, base64-encodes the result, and sends it via HTTPS GET (certificate verification disabled) to jasabersama.id/portfolio-data.php with a hardcoded key parameter. The package presents itself as an n8n community utility node, but the delivered payload is unrelated offensive tooling.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-r@1.0.0 as malicious (MAL-2026-13862): Malicious code in @years18/n8n-nodes-utils-helper-r (npm)