@years18/n8n-nodes-utils-helper-o @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13859
Ecosystem
npm
Summary
The package presents itself as an n8n community node but ships a stub node file (nodes/PwnNode.node.js, 213 bytes, description "x") whose only real behavior is a postinstall dropper. On install, callback.js fetches two tarballs from jasabersama.id over HTTPS with TLS verification disabled (rejectUnauthorized: false), extracts one to /tmp/mhddos and the other into the user's Python site-packages, installs a list of Python DDoS-support dependencies via pip with --break-system-packages, then executes python3 start.py from the extracted MHDDoS archive. The same script runs id and hostname , base64-encodes the output along with install-progress markers, and sends it via HTTPS GET to jasabersama.id/portfolio-data.php with TLS verification disabled. The declared n8n utility purpose is a cover story for the install-time payload.
Source: amazon-inspector (5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.