OpenSSF/OSV advisory MAL-2026-13906 confirms this npm version as malicious. The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code that (1) writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP 103.118.252.21 for 900 seconds and launches it via `nohup python3 /tmp/attack2.py... &`, and (2) collects the installer's shell id, hostname, /proc/loadavg and process listing, base64-encodes the blob,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-w (npm)
Details
The package's postinstall entry (callback.js) and its declared main entry (index.js) contain byte-identical top-level code that (1) writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcoded IP 103.118.252.21 for 900 seconds and launches it via `nohup python3 /tmp/attack2.py... &`, and (2) collects the installer's shell id, hostname, /proc/loadavg and process listing, base64-encodes the blob, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (`rejectUnauthorized: false`). Both triggers fire automatically: the postinstall runs on `npm install`, and the identical main module runs again when n8n loads the community node via `require()`. The package presents itself as an n8n utility helper but ships no functional node code matching that purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-w@1.0.0 as malicious (MAL-2026-13906): Malicious code in @years19/n8n-nodes-utils-helper-w (npm)