@years19/n8n-nodes-utils-helper-h @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13891
Ecosystem
npm
Summary
On install, callback.js (also present as index.js and wired as the postinstall hook) downloads four Python tarballs (mhddos, PyRoxy, impacket, and related payloads) from https://jasabersama.id/assets/cache/.theme-backup/dl/ over TLS with certificate validation disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches python3 start.py in the background. Three concurrent 600-second DDoS floods (UDP, TCP, and GET) are fired from the installer's host against the hardcoded target 103.118.252.21 on ports 80/443. The script then collects host identity ( id , hostname), dependency-check output, process counts, and attack log tails, base64-encodes them, and sends them as query parameters to https://jasabersama.id/portfolio-data.php with a hardcoded key. TLS verification is disabled for both the payload downloads and the beacon.
Source: amazon-inspector (690b884eaa3ac12bdca74814577c4d42fb0811ee22ebc20687f809ad3e293755)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.