MAL-2026-13884 Malicious code in @years19/n8n-nodes-utils-helper-a (npm)

The package advertises itself as an n8n utility helper and registers a trivial stub node (nodes/PwnNode.node.js), but its postinstall lifecycle script performs the actual behavior. On install it fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), extracts it into the user's Python site-packages directory, and invokes attack tooling from the dropped archive (PyRoxy, impacket, mhddos /tmp/mhddos/start.py). The same postinstall executes id and hostname on the installer's machine, base64-encodes the output together with results from the dropped payload, and sends them to https://jasabersama.id/portfolio-data.php via an https.get whose path smuggles a base64-piped shell command. Installing the package results in attacker-controlled code being written to the Python import path and executed on the installer's host, and installer identity/execution results being transmitted to the author-controlled endpoint.