OpenSSF/OSV advisory MAL-2026-13898 confirms this npm version as malicious. On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-o (npm)
Details
On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes `id` and `hostname`, base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-o@1.0.0 as malicious (MAL-2026-13898): Malicious code in @years19/n8n-nodes-utils-helper-o (npm)