OpenSSF/OSV advisory MAL-2026-13866 confirms this npm version as malicious. The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity (`id`, hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years18/n8n-nodes-utils-helper-v (npm)
Details
The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity (`id`, hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The same postinstall path installs the impacket network-attack library via `pip install --break-system-packages`, probes PyRoxy, and attempts to execute /tmp/mhddos/start.py (MHDDoS). Installing this package auto-runs reconnaissance, exfiltrates installer host identifiers to a hardcoded third-party endpoint, and stages offensive DDoS/network-attack tooling on the installer's machine.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years18/n8n-nodes-utils-helper-v@1.0.0 as malicious (MAL-2026-13866): Malicious code in @years18/n8n-nodes-utils-helper-v (npm)