OpenSSF/OSV advisory MAL-2026-13901 confirms this npm version as malicious. The package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `npm install` and `require('@years19/n8n-nodes-utils-helper-r')` trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from `https://jasabersama.id/assets/cache/.theme-backup/dl/` over TLS with certificate validation disabled...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-r (npm)
Details
The package declares `postinstall: node callback.js` and its `main` (index.js) is byte-identical to callback.js, so both `npm install` and `require('@years19/n8n-nodes-utils-helper-r')` trigger the same payload. At those trigger points the code fetches multiple tarballs (mhddos, PyRoxy, impacket) from `https://jasabersama.id/assets/cache/.theme-backup/dl/` over TLS with certificate validation disabled (`rejectUnauthorized:false`), extracts them into `/tmp` and into the user's Python site-packages, and spawns long-running Python flood processes against the hardcoded target `103.118.252.21:80` via `nohup python3 start.py UDP 103.118.252.21:80... &`. In parallel, callback.js/index.js collect installer host identity (`id`, `hostname`, Python version, dependency presence, attack log tails), base64-encode the output, and send it in a query string to `https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=<b64>`. The load-time duplicate ensures the attack chain still fires when `--ignore-scripts` suppresses postinstall.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-r@1.0.0 as malicious (MAL-2026-13901): Malicious code in @years19/n8n-nodes-utils-helper-r (npm)