@years18/n8n-nodes-utils-helper-c@1.0.0
Vulnerability report · Last retrieved from osv.dev October 8, 2026 at 2:37 AM UTC
OSV ID
MAL-2026-13849
Ecosystem
npm
Summary
On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz with TLS verification disabled (rejectUnauthorized:false), extracts it under /tmp, pip-installs its requirements with --break-system-packages, and executes python3 start.py — the archive name and structure correspond to the MHDDoS attack tool. Second, it runs id, hostname, and a ps aux filtered for implant, base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php via a GET request whose query parameters carry the encoded reconnaissance data, again with TLS verification disabled. Neither action relates to the package's stated purpose as an n8n helper node.
Source: amazon-inspector (55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.