MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

The package's postinstall script and its main entry (index.js, byte-identical to callback.js) execute the same payload on npm install and on require(). The payload runs id and hostname, base64-encodes the output, and sends it to https://jasabersama.id/portfolio-data.php with k= and c= query parameters; TLS certificate verification is disabled (rejectUnauthorized:false). The c= parameter carries a base64-decode-and-append shell command written to /tmp/n8n_rce_result.txt, giving the operator a server-driven command channel. The same script pip-installs impacket with --break-system-packages, probes for PyRoxy, and executes python3 start.py under /tmp/mhddos — staging and running an mhddos DDoS toolkit on the installer host. The package name mimics a legitimate n8n community node to lure installation.