MAL-2026-13885 Malicious code in @years19/n8n-nodes-utils-helper-b (npm)

Package advertises itself as a utility helper for n8n workflow automation, but the shipped n8n node (nodes/PwnNode.node.js) is a 213-byte stub with no functionality. The postinstall hook — duplicated in the main index.js — shells out to collect the output of id and hostname, downloads https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz to /tmp/multidict.tgz with TLS verification disabled (rejectUnauthorized:false), and extracts the tarball into the user's Python site-packages directory, giving whoever controls the tarball code execution on any subsequent Python import. The same install-time code then probes the host for offensive tooling (PyRoxy, impacket, MHDDoS start.py), base64-encodes the recon output together with the id/hostname/site-path values, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php. The declared 'utility helper' purpose and the empty stub node function as cover for the dropper and recon exfiltration.