@years19/n8n-nodes-utils-helper-d @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13887
Ecosystem
npm
Summary
The package presents itself as an n8n community node ( n8n-nodes-utils-helper-d ) but its actual on-install behavior is unrelated to workflow automation. The postinstall script fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over an HTTPS connection with TLS certificate validation disabled ( rejectUnauthorized:false ) and extracts it into the user's Python site-packages, shadowing the real multidict module so subsequent import multidict in the environment executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and /tmp/mhddos/start.py , consistent with a DDoS / offensive-tooling dropper. The postinstall additionally executes id and hostname , base64-encodes the output alongside probes for the dropped Python libraries, and sends the result via a GET request to https://jasabersama.id/portfolio-data.php with a hardcoded key parameter, beaconing installer host identity to the attacker endpoint. The shipped node file is a stub named PwnNode.node.js , and no legitimate n8n node functionality is present.
Source: amazon-inspector (72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.