OpenSSF/OSV advisory MAL-2026-13902 confirms this npm version as malicious. The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds — and launches it in the background via nohup python3. The same code path is present in index.js, which is declared as the package `main`, so require()ing the module re-triggers the dropper even when installation runs with --ignore-scripts...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-s (npm)
Details
The package's postinstall script writes /tmp/attack.py — a Python UDP/TCP flooder targeting the hardcoded IP 103.118.252.21 on ports 80/443 for 600 seconds — and launches it in the background via nohup python3. The same code path is present in index.js, which is declared as the package `main`, so require()ing the module re-triggers the dropper even when installation runs with --ignore-scripts. Both files also collect installer host identity (`id`, `hostname`, process listing, /proc/loadavg), base64-encode the data, and send it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized: false). The package presents itself as an n8n utility node but contains no such functionality; its only behavior is host reconnaissance exfiltration and using the installer's machine as a DDoS bot against a third-party target.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-s@1.0.0 as malicious (MAL-2026-13902): Malicious code in @years19/n8n-nodes-utils-helper-s (npm)