@years19/n8n-nodes-utils-helper-i @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 5:28 AM UTC
OSV ID
MAL-2026-13892
Ecosystem
npm
Summary
The package's postinstall script executes callback.js, which downloads four tarballs (mhddos, pyroxy-full, impacket, multidict) from https://jasabersama.id/assets/cache/.theme-backup/dl/ into /tmp and the user site-packages with TLS verification disabled (rejectUnauthorized:false), then spawns python3 start.py to launch UDP/TCP/GET flood traffic against the hardcoded target 103.118.252.21. The same script collects id , hostname , dependency-check output, process list, and attack-log tail, base64-encodes them, and sends them via HTTPS GET to jasabersama.id/portfolio-data.php as a beacon. The package's declared main entry index.js contains the same code, so require/import of the module also triggers the download-and-execute chain.
Source: amazon-inspector (3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.