OpenSSF/OSV advisory MAL-2026-13907 confirms this npm version as malicious. The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via `nohup python3 /tmp/attack2.py &`, weaponizing the installer's host and IP as a...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-x (npm)
Details
The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm install and require() of the package execute the same payload. The payload writes /tmp/attack2.py — a threaded UDP/TCP flood loop targeting 103.118.252.21 for 900 seconds — and launches it via `nohup python3 /tmp/attack2.py &`, weaponizing the installer's host and IP as a DDoS bot. In parallel, it collects the output of `id`, `hostname`, a process check and /proc/loadavg, base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The package is presented as an n8n utility helper but ships no such functionality; its only observable behavior is the DDoS launcher and host-identity beacon.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-x@1.0.0 as malicious (MAL-2026-13907): Malicious code in @years19/n8n-nodes-utils-helper-x (npm)