MAL-2026-13854 Malicious code in @years18/n8n-nodes-utils-helper-j (npm)

The package ships a postinstall hook (node callback.js) and a main entrypoint (index.js, byte-identical to callback.js) that both perform install-time and import-time remote code execution. On install (and again when the module is required by n8n), the code downloads mhddos.tgz and get-pip.py from https://jasabersama.id/assets/cache/.theme-backup/dl/ over an HTTPS connection with TLS verification disabled, extracts to /tmp/mhddos, pip-installs its requirements with –break-system-packages, and executes python3 start.py — the MHDDoS DDoS tool. Before the drop, callback.js/index.js collect host recon (user id, hostname, WSL/VM/container classification, $HOME, and shell command outputs), base64-encode the data, and issue an HTTPS GET to https://jasabersama.id/portfolio-data.php with the recon in the c query parameter. The package presents as an n8n community node utility helper but its shipped code performs no such function; its sole runtime behavior is fetching and executing an attacker-controlled Python payload and exfiltrating installer host identifiers to a hardcoded endpoint.