OpenSSF/OSV advisory MAL-2026-13885 confirms this npm version as malicious. Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js) is a 213-byte stub with no functionality. The postinstall hook — duplicated in the main index.js — shells out to collect the output of `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp/multidict.tgz with TLS verification disabled...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-b (npm)
Details
Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js) is a 213-byte stub with no functionality. The postinstall hook — duplicated in the main index.js — shells out to collect the output of `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), and extracts the tarball into the user's Python site-packages directory, giving whoever controls the tarball code execution on any subsequent Python import. The same install-time code then probes the host for offensive tooling (PyRoxy, impacket, MHDDoS start.py), base64-encodes the recon output together with the id/hostname/site-path values, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php. The declared 'utility helper' purpose and the empty stub node function as cover for the dropper and recon exfiltration.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-b@1.0.0 as malicious (MAL-2026-13885): Malicious code in @years19/n8n-nodes-utils-helper-b (npm)