@years19/n8n-nodes-utils-helper-b @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13885
Ecosystem
npm
Summary
Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js) is a 213-byte stub with no functionality. The postinstall hook — duplicated in the main index.js — shells out to collect the output of id and hostname , downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), and extracts the tarball into the user's Python site-packages directory, giving whoever controls the tarball code execution on any subsequent Python import. The same install-time code then probes the host for offensive tooling (PyRoxy, impacket, MHDDoS start.py), base64-encodes the recon output together with the id/hostname/site-path values, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php. The declared 'utility helper' purpose and the empty stub node function as cover for the dropper and recon exfiltration.
Source: amazon-inspector (a351b02a61973662e99b6b37c696ef8156d4e95832500ca99d7123e01e5f4bbf)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.