Malicious code in @years19/n8n-nodes-utils-helper-n (npm)

The package @years19/n8n-nodes-utils-helper-n was published to npm with a postinstall script that executes malicious code. The package.json declares a postinstall hook running node callback.js, and the main entry point (index.js) is byte-identical to callback.js, ensuring the payload executes both during npm install and on any subsequent require() of the package.\n\nThe payload fetches four tarballs (mhddos, pyroxy-full, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled, extracts them into /tmp and the user's site-packages directory, and launches three background Python3 processes running mhddos in UDP, TCP, and GET attack modes against the IP address 103.118.252.21. This weaponizes the installer's host as a DDoS participant.\n\nThe malicious code also collects system information via id and hostname commands, base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled, exfiltrating system identity data.\n\nThe package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-13897.