@years18/n8n-nodes-utils-helper-m @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13857
Ecosystem
npm
Summary
The package's declared postinstall script ( node callback.js ) and its main entrypoint ( index.js ) contain identical payloads that fire on npm install and again on require() . The payload downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy.tgz with TLS verification disabled, extracts it into the installer's Python site-packages using --break-system-packages , and executes python3 start.py from /tmp/mhddos (the mhddos / PyRoxy DDoS tool). The same code collects the installer's user id, hostname, and command-execution output, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php?k=S7k9xQ2mZj&c=... , again with rejectUnauthorized: false . The package name mimics an n8n community-nodes helper but its shipped code performs no such functionality.
Source: amazon-inspector (5db497bbce490daad792ade6e502a9d382634c48047a6be6fcf31fd731bf6a53)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.