OpenSSF/OSV advisory MAL-2026-13908 confirms this npm version as malicious. The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.node.js"] with description 'Utility helper nodes for workflow automation'), but its callback.js (invoked from the declared postinstall hook `node callback.js`) and its main entry index.js contain identical top-level code that: (1) writes a Python script to /tmp/attack2.py and launches it via `nohup...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @years19/n8n-nodes-utils-helper-y (npm)
Details
The package advertises itself as an n8n community utility helper node (package.json declares n8n.nodes: ["nodes/PwnNode.node.js"] with description 'Utility helper nodes for workflow automation'), but its callback.js (invoked from the declared postinstall hook `node callback.js`) and its main entry index.js contain identical top-level code that: (1) writes a Python script to /tmp/attack2.py and launches it via `nohup python3 /tmp/attack2.py... &`, which floods 103.118.252.21 on ports 80/443 with UDP/TCP traffic using 2000 threads for 900 seconds; and (2) collects host identity (uid, hostname, process/load information), base64-encodes it, and sends it over HTTPS GET to jasabersama.id/portfolio-data.php with TLS certificate verification disabled (rejectUnauthorized:false). Because the dropper is both in the postinstall script and at the top level of the main module, it executes on `npm install` and again every time a consumer `require`s the package or n8n loads the node.
Decision reason
OpenSSF Malicious Packages via OSV confirms @years19/n8n-nodes-utils-helper-y@1.0.0 as malicious (MAL-2026-13908): Malicious code in @years19/n8n-nodes-utils-helper-y (npm)