@years19/n8n-nodes-utils-helper-m @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13896
Ecosystem
npm
Summary
On npm install, the package's postinstall script (callback.js / index.js) fetches mhddos, PyRoxy, impacket, and multidict tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled (rejectUnauthorized:false), extracts them into /tmp and the user's Python site-packages, and launches three long-running python3 processes that direct traffic at a hardcoded target IP, turning the installer's host into a DDoS bot. The same script runs id and hostname , base64-encodes the output, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php, with the URL also carrying a c= parameter shell-composed to write attacker-supplied base64 content into /tmp/n8n_rce_result.txt. The package name suggests an n8n-nodes utility but the shipped code contains no such functionality.
Source: amazon-inspector (85113dcbea98d25a66f14a975ab391a33a72964b38c916b386125857e35ca268)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.