@years19/n8n-nodes-utils-helper-o @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13898
Ecosystem
npm
Summary
On npm install (postinstall runs callback.js) and again on require of the package (identical payload in index.js as the declared main), the package downloads Python DDoS tooling (mhddos, PyRoxy, impacket, multidict tarballs) from https://jasabersama.id/assets/cache/.theme-backup/dl/ with TLS certificate validation disabled (rejectUnauthorized:false), extracts them under /tmp and the user site-packages, then spawns three detached python3 processes to flood 103.118.252.21 on UDP/80, TCP/443, and GET/80. The same script executes id and hostname , base64-encodes the output along with attack process status, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key over the same TLS-verification-disabled channel. The package name mimics an n8n community node, so importing it inside an n8n instance re-triggers the payload via automatic node loading.
Source: amazon-inspector (79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.