OpenSSF/OSV advisory MAL-2026-13892 confirms this npm version as malicious. The package's postinstall script executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ into /tmp and the user site-packages with TLS verification disabled (rejectUnauthorized:false), then spawns python3 start.py to launch UDP/TCP/GET flood traffic against the hardcoded target 103.118.252.21...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-i (npm)
Details
The package's postinstall script executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ into /tmp and the user site-packages with TLS verification disabled (rejectUnauthorized:false), then spawns python3 start.py to launch UDP/TCP/GET flood traffic against the hardcoded target 103.118.252.21. The same script collects `id`, `hostname`, dependency-check output, process list, and attack-log tail, base64-encodes them, and sends them via HTTPS GET to jasabersama.id/portfolio-data.php as a beacon. The package's declared main entry index.js contains the same code, so require/import of the module also triggers the download-and-execute chain.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-i@1.0.0 as malicious (MAL-2026-13892): Malicious code in @years19/n8n-nodes-utils-helper-i (npm)