MAL-2026-13848 Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

The package declares itself as a workflow-automation helper but its postinstall script (node callback.js) fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/mhddos.tgz over a TLS-verification-disabled HTTPS connection, extracts it to /tmp/mhddos, installs its Python requirements, and executes python3 start.py. In parallel, the script collects installer host identity (id, hostname) and the output of the tar/pip/execute steps, base64-encodes them, and sends them as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate validation disabled). The remote path is staged under a decoy /assets/cache/.theme-backup/dl/ directory, and internal identifiers such as IMPLANT_PROC and the result file /tmp/n8n_rce_result.txt correspond to implant behavior rather than a helper library. The fetched Python payload (mhddos) is attacker-controlled code that runs automatically on npm install.