OpenSSF/OSV advisory MAL-2026-13888 confirms this npm version as malicious. Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte stub. The real behavior is in the postinstall lifecycle script: it collects host identity via `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp with TLS verification disabled (rejectUnauthorized:false), extracts the archive into the user's...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-e (npm)
Details
Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte stub. The real behavior is in the postinstall lifecycle script: it collects host identity via `id` and `hostname`, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp with TLS verification disabled (rejectUnauthorized:false), extracts the archive into the user's Python site-packages, probes for and stages offensive Python libraries (mhddos, PyRoxy, impacket), and executes /tmp/mhddos/start.py. Captured host identity and probe output are base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php, again with TLS verification disabled. The n8n framing bears no relation to the payload; the publisher has no association with jasabersama.id.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-e@1.0.0 as malicious (MAL-2026-13888): Malicious code in @years19/n8n-nodes-utils-helper-e (npm)