MAL-2026-13886 Malicious code in @years19/n8n-nodes-utils-helper-c (npm)

The npm package's postinstall script (callback.js) resolves the user's Python site-packages directory and downloads a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over TLS with certificate verification disabled (rejectUnauthorized:false). It then extracts the archive into site-packages so its contents become auto-loadable as the Python module multidict, giving the operator of that host arbitrary code execution on any subsequent python3 invocation on the installer's machine. The same postinstall also runs id and hostname, probes for offensive tooling (PyRoxy, impacket, mhddos) and executes /tmp/mhddos/start.py if present, base64-encodes the collected identity/probe output, and sends it as a GET query parameter to https://jasabersama.id/portfolio-data.php with a hardcoded key, also with certificate verification disabled. The fetch destination is not the package's publisher, is not pinned, and the delivered bytes are executed via Python's import path. The package name mimics a legitimate n8n community node.