@years18/n8n-nodes-utils-helper-c @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13849
Ecosystem
npm
Summary
On npm install , the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz with TLS verification disabled ( rejectUnauthorized:false ), extracts it under /tmp, pip-installs its requirements with --break-system-packages , and executes python3 start.py — the archive name and structure correspond to the MHDDoS attack tool. Second, it runs id , hostname , and a ps aux filtered for implant , base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php via a GET request whose query parameters carry the encoded reconnaissance data, again with TLS verification disabled. Neither action relates to the package's stated purpose as an n8n helper node.
Source: amazon-inspector (55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.