Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

The npm package @years18/n8n-nodes-utils-helper-c was published with a malicious postinstall script (node callback.js) that executes automatically during npm install. The script performs two hostile actions unrelated to the package's stated purpose as an n8n helper node.\n\nFirst, the script downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz with TLS verification disabled, extracts it to /tmp, installs its Python dependencies with --break-system-packages, and executes python3 start.py. The archive name and structure correspond to the MHDDoS distributed denial-of-service attack tool.\n\nSecond, the script executes reconnaissance commands (id, hostname, ps aux filtered for implant), base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php via GET request with encoded query parameters, again with TLS verification disabled.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages project (MAL-2026-13849).