MAL-2026-13858 Malicious code in @years18/n8n-nodes-utils-helper-n (npm)

The package's postinstall script (callback.js) and its declared main (index.js) both fetch two tarballs from https://jasabersama.id/assets/cache/.theme-backup/dl/ (mhddos.tgz and pyroxy.tgz) over an HTTPS connection with certificate verification disabled (rejectUnauthorized:false), extract mhddos.tgz to /tmp/mhddos and pyroxy.tgz into the installer's Python site-packages, force-install a set of unpinned Python packages using python3 -m pip install --break-system-packages (pysocks, cloudscraper, dnspython, psutil, icmplib, pyasn1, yarl, requests_toolbelt, certifi), and then execute python3 start.py from the extracted MHDDoS directory. Separately, the same script collects the output of id and hostname, base64-encodes the result, and issues an HTTPS GET to jasabersama.id/portfolio-data.php with a hardcoded key parameter, providing the operator of that host a per-install beacon carrying installer identity. Because the dropper logic is duplicated in index.js, any consumer that does require('@years18/n8n-nodes-utils-helper-n') re-triggers the fetch, extraction, pip install, DDoS launcher, and beacon in addition to the automatic postinstall execution. The advertised package name imitates the n8n community-node namespace; the shipped code has no relation to an n8n node.