MAL-2026-13863 Malicious code in @years18/n8n-nodes-utils-helper-s (npm)

The package's postinstall lifecycle script downloads two tarballs (mhddos.tgz, pyroxy.tgz) from jasabersama.id over an HTTPS connection with TLS verification disabled (rejectUnauthorized:false), extracts them to /tmp and into the Python user site-packages, pip-installs a fixed dependency set with –break-system-packages, and immediately runs python3 start.py from the extracted mhddos directory. In parallel, it collects the output of id and hostname plus install-progress markers, base64-encodes them, and sends them as a query-string parameter to https://jasabersama.id/portfolio-data.php with a fixed key S7k9xQ2mZj. The payload URL is staged under a .theme-backup/dl/ cover-story path on a domain unrelated to the package's declared purpose, and the package's n8n node file is a stub — the sole functional code is the malicious postinstall. The name mimics legitimate n8n community node packages.