@years18/n8n-nodes-utils-helper-v @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13866
Ecosystem
npm
Summary
The package masquerades as an n8n community node (name @years18/n8n-nodes-utils-helper-v, node file nodes/PwnNode.node.js with an empty 'x' description) while the real behavior is in a postinstall dropper. On npm install the postinstall script collects host identity ( id , hostname) via callback.js, base64-encodes the result, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with TLS verification disabled (rejectUnauthorized:false). The same postinstall path installs the impacket network-attack library via pip install --break-system-packages , probes PyRoxy, and attempts to execute /tmp/mhddos/start.py (MHDDoS). Installing this package auto-runs reconnaissance, exfiltrates installer host identifiers to a hardcoded third-party endpoint, and stages offensive DDoS/network-attack tooling on the installer's machine.
Source: amazon-inspector (9923595138c727382a8b1e870530f6d55ded8a052ee374569ad8b87b1560c07f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.