OpenSSF/OSV advisory MAL-2026-13895 confirms this npm version as malicious. The package's postinstall script and its main entrypoint (index.js, byte-identical to callback.js) fetch four tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extract them into /tmp and the user's Python site-packages, and spawn backgrounded python3 processes running MHDDoS UDP/TCP/GET flood...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-l (npm)
Details
The package's postinstall script and its main entrypoint (index.js, byte-identical to callback.js) fetch four tarballs (mhddos, PyRoxy, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extract them into /tmp and the user's Python site-packages, and spawn backgrounded python3 processes running MHDDoS UDP/TCP/GET flood attacks against 103.118.252.21. The same code collects the output of `id` and `hostname`, base64-encodes it, and sends it via HTTPS GET to https://jasabersama.id/portfolio-data.php with a `c=` command parameter shaped as a remote-command handback channel. Because index.js is declared as `main`, the payload fires both on `npm install` (postinstall) and whenever a consumer require()s or imports the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-l@1.0.0 as malicious (MAL-2026-13895): Malicious code in @years19/n8n-nodes-utils-helper-l (npm)