@years19/n8n-nodes-utils-helper-e @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13888
Ecosystem
npm
Summary
Package presents itself as an n8n community utility node, but the shipped node file (nodes/PwnNode.node.js) is a 213-byte stub. The real behavior is in the postinstall lifecycle script: it collects host identity via id and hostname , downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp with TLS verification disabled (rejectUnauthorized:false), extracts the archive into the user's Python site-packages, probes for and stages offensive Python libraries (mhddos, PyRoxy, impacket), and executes /tmp/mhddos/start.py. Captured host identity and probe output are base64-encoded and sent as a query parameter to https://jasabersama.id/portfolio-data.php, again with TLS verification disabled. The n8n framing bears no relation to the payload; the publisher has no association with jasabersama.id.
Source: amazon-inspector (d5383b810a9933c1d20ffbcb7fbc4f7477c6603e5e7fe955d8380f765be69d8b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.