MAL-2026-13887 Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

The package presents itself as an n8n community node (n8n-nodes-utils-helper-d) but its actual on-install behavior is unrelated to workflow automation. The postinstall script fetches a tarball from https://jasabersama.id/assets/cache/.theme-backup/dl/multidict.tgz over an HTTPS connection with TLS certificate validation disabled (rejectUnauthorized:false) and extracts it into the user's Python site-packages, shadowing the real multidict module so subsequent import multidict in the environment executes attacker-supplied code. Follow-up shell activity references PyRoxy/impacket and /tmp/mhddos/start.py, consistent with a DDoS / offensive-tooling dropper. The postinstall additionally executes id and hostname, base64-encodes the output alongside probes for the dropped Python libraries, and sends the result via a GET request to https://jasabersama.id/portfolio-data.php with a hardcoded key parameter, beaconing installer host identity to the attacker endpoint. The shipped node file is a stub named PwnNode.node.js, and no legitimate n8n node functionality is present.