@years18/n8n-nodes-utils-helper-r @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13862
Ecosystem
npm
Summary
@years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install , downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/pyroxy-full.tgz over TLS with certificate verification disabled and extracts it into the installer's Python site-packages directory, then verifies the drop by executing python3 start.py from /tmp/mhddos. The dropped payload is the PyRoxy / MHDDOS DDoS attack framework. The same postinstall collects the output of id and hostname , base64-encodes the result, and sends it via HTTPS GET (certificate verification disabled) to jasabersama.id/portfolio-data.php with a hardcoded key parameter. The package presents itself as an n8n community utility node, but the delivered payload is unrelated offensive tooling.
Source: amazon-inspector (be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.