MAL-2026-13867 Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

This package presents itself as an n8n workflow helper but ships a near-empty node stub (nodes/PwnNode.node.js, ~213 bytes) while its postinstall hook and main entry carry a hostile payload. package.json declares postinstall: node callback.js, and index.js is a byte-identical copy of callback.js, so both npm install and require() execute the same code. The payload runs id and hostname, probes for Python packages, executes a staged tool at /tmp/mhddos/start.py (the MHDDoS attack toolkit), base64-encodes the aggregated output, and sends it as a URL query parameter to https://jasabersama.id/portfolio-data.php over HTTPS with TLS verification disabled (rejectUnauthorized:false). It also runs python3 -m pip install --quiet --break-system-packages impacket, mutating the installer's system Python environment, and executes attacker-staged code from /tmp. The mismatch between the advertised n8n-helper purpose and the shipped functionality — plus duplication of the payload across both auto-executed surfaces — indicates the declared purpose is a cover for the attack.