OpenSSF/OSV advisory MAL-2026-13896 confirms this npm version as malicious. On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches three long-running python3 processes that direct traffic at a hardcoded target IP,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-m (npm)
Details
On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches three long-running python3 processes that direct traffic at a hardcoded target IP, turning the installer's host into a DDoS bot. The same script runs `id` and `hostname`, base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, with the URL also carrying a `c=` parameter shell-composed to write attacker-supplied base64 content into /tmp/n8n_rce_result.txt. The package name suggests an n8n-nodes utility but the shipped code contains no such functionality.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-m@1.0.0 as malicious (MAL-2026-13896): Malicious code in @years19/n8n-nodes-utils-helper-m (npm)